CVE-2022-2879 — Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing…
Published: 2022-10-14 · CVSS: Unscored
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7