title: Unbounded memory consumption when reading headers in archive/tar
description: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
problem types: CWE 400: Uncontrolled Resource Consumption
affected:
{
vendor: Go standard library
product: archive/tar
collectionURL: https://pkg.go.dev
packageName: archive/tar
versions:
version: 0, lessThan: 1.18.7, status: affected, versionType: semver
version: 1.19.0-0, lessThan: 1.19.2, status: affected, versionType: semver
programRoutines:
name: Reader.next
name: parsePAX
name: Writer.writePAXHeader
name: Reader.Next
name: Writer.WriteHeader
defaultStatus: unaffected
}