CVE-2026-109380 ayuhito CVE debrief

Who should care

Defenders responsible for systems using modern-tar versions 0.3.5 through 0.8.5 should assess exposure and prioritize remediation to prevent potential security breaches. This includes verifying inventory, upgrading to a patched version, and monitoring for suspicious archive unpacking activity. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated

Why it matters

Defenders should care about CVE-2026-109380 because it allows attackers to cause memory exhaustion in modern-tar, potentially leading to denial of service and impacting system stability.

• Potential denial of service due to memory exhaustion
• Possible impact on system stability and performance

Technical summary

The modern-tar library is vulnerable to a memory exhaustion attack when parsing malformed octal size fields in tar archives. This allows attackers to cause memory exhaustion, potentially leading to denial of service and impacting system stability. The vulnerability is caused by the library's inability to handle malformed octal size fields in tar archives, which can be exploited by supplying a crafted archive to unpackTar(). Defenders should prioritize verifying inventory and upgrading to a patched version to prevent potential security breaches.

Defensive priority

Defenders should prioritize verifying inventory and upgrading to a patched version.

Recommended defensive actions

• Verify inventory of modern-tar versions 0.3.5 through 0.8.5
• Upgrade to a patched version
• Monitor for suspicious archive unpacking activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). The modern-tar library does not properly handle malformed octal size fields in tar archives, leading to memory exhaustion. This can be exploited by supplying a crafted, optionally gzip-compressed, archive to unpackTar(). The vulnerability has been identified in modern-tar versions 0.3.5 through 0.8.5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.