CVE-2026-32288: Unbounded allocation for old GNU sparse in archive/tar
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
Other sources
Unbounded allocation for old GNU sparse in archive/tar
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.4-10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.62.0-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.62.0-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.62.0-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.3-17
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32288?
CVE-2026-32288 has a high severity due to the potential for unbounded memory allocation when processing maliciously crafted archives.
How do I fix CVE-2026-32288?
To mitigate CVE-2026-32288, upgrade to Go version 1.26.2 or later, where the vulnerability is addressed.
What types of software are affected by CVE-2026-32288?
CVE-2026-32288 affects the Go archive/tar package versions up to 1.26.2 and earlier versions of Golang Go.
What impact does CVE-2026-32288 have on systems?
CVE-2026-32288 can lead to denial of service by consuming excessive memory resources when processing specific tar archives.
Is CVE-2026-32288 exploitable remotely?
Yes, CVE-2026-32288 can be exploited remotely by an attacker crafting a malicious tar archive.