PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9538 BINGOS CVE debrief

Archive::Tar versions before 3.10 for Perl contain a memory exhaustion vulnerability. The _read_tar() function reads each entry's payload using $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header without an upper bound. A crafted tar header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size, leading to memory exhaustion. The vulnerability was published on 2026-05-26 and last modified on 2026-05-26. The issue is classified under CWE-789 (Uncontrolled Memory Allocation). A patch is available in version 3.10.

Vendor
BINGOS
Product
Archive::Tar
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

System administrators running Perl applications that process untrusted tar archives, developers using Archive::Tar in web applications or automated processing pipelines, and security teams monitoring for denial-of-service vectors in archive handling components.

Technical summary

The vulnerability exists in Archive::Tar's _read_tar() function, which reads tar entry payloads by allocating memory based on the size field declared in the tar header. The 12-byte size field is parsed without validation or upper bounds checking. An attacker can craft a malicious tar archive with an artificially inflated size value (multi-gigabyte), causing immediate memory allocation of that size when Perl attempts to create the scalar. This results in memory exhaustion and potential denial of service. The fix in version 3.10 implements proper bounds checking on the size field before memory allocation occurs.

Defensive priority

high

Recommended defensive actions

  • Upgrade Archive::Tar to version 3.10 or later to address the memory exhaustion vulnerability.
  • Validate tar file headers before processing, implementing size limits on declared entry sizes to prevent excessive memory allocation.
  • Monitor systems processing untrusted tar archives for signs of memory exhaustion or denial-of-service conditions.
  • Review application code that uses Archive::Tar to ensure proper input validation and resource limits are enforced.

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. The fix is confirmed by the commit patch and version 3.10 changelog on MetaCPAN. The oss-security mailing list post provides additional disclosure context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9538 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9538

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9538 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9538

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e - Release Notes

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.