GO-2026-6905: Panic on negative member size in Reader.Read in github.com/blakesmith/ar

Published Nov 5, 2026

Updated

Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.

Affected Software

1 affected component

go/github.com/blakesmith/ar*

Event History

Nov 5, 2026

Advisory Published

via OSV·10:55 PM

Data Sourced

via OSV·10:55 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using github.com/blakesmith/ar are exposed when they process archive member headers that may contain attacker-controlled size fields. A malicious header with a negative decimal size can trigger the failure.

What does an attacker need to do to trigger the panic?

The attacker needs to provide an archive whose 10-byte member size field parses as a negative integer. After Reader.Next processes that header, a subsequent call to Reader.Read can panic with a slice bounds out of range error.

How can I tell whether my application is affected?

Review whether your application uses github.com/blakesmith/ar and calls Reader.Next followed by Reader.Read on archives from untrusted or insufficiently validated sources. A panic reporting a slice bounds out of range error during Reader.Read after processing a member with a negative size is consistent with this issue.

GO-2026-6905: Panic on negative member size in Reader.Read in github.com/blakesmith/ar

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the panic?

How can I tell whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the panic?

How can I tell whether my application is affected?