Repository navigation
archive/tar: unbounded allocation when parsing old format GNU sparse map #78301
Description
Activity
@gopherbot please open backport issues for this security fix
Backport issue(s) opened: #78414 (for 1.25), #78415 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
Change https://go.dev/cl/763547 mentions this issue:
[release-branch.go1.26] archive/tar: limit the number of old GNU sparse format entriesChange https://go.dev/cl/763554 mentions this issue:
[release-branch.go1.25] archive/tar: limit the number of old GNU sparse format entries- changed the title
[-]security: fix CVE-2026-32288[/-][+] archive/tar: unbounded allocation when parsing old format GNU sparse map[/+]on Apr 7, 2026 Change https://go.dev/cl/763766 mentions this issue:
archive/tar: limit the number of old GNU sparse format entries- added a commit that references this issue
on Apr 8, 2026
tar.Reader could allocate an unbounded amount of memory when reading
a maliciously-crafted archive containing a large number of sparse
regions encoded in the "old GNU sparse map" format.
We now limit both the number of old GNU sparse map extension blocks,
and the total number of sparse file entries, regardless of encoding.
Thanks to Colin Walters ([email protected]) who initially reported this issue.
Thanks also to Uuganbayar Lkhamsuren (https://github.com/uug4na) and Jakub Ciolek
who additionally reported this issue.
This is CVE-2026-32288 and Go issue https://go.dev/issue/78301.
This is a PRIVATE issue for CVE-2026-32288, tracked in http://b/489152796 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3901.
/cc @golang/security and @golang/release