Executive Summary

CVE-2026-9538 is a vulnerability in Archive::Tar versions before 3.10 for Perl that allows an attacker to cause memory exhaustion. This happens because the _read_tar() function reads the size of each tar entry from a 12-byte size field in the tar header without any upper limit. An attacker can craft a tar header that declares an extremely large size, causing Perl to allocate a very large amount of memory, potentially leading to a denial-of-service condition.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a memory denial-of-service (DoS) attack. When processing a malicious tar archive with an excessively large declared entry size, the system running Archive::Tar may allocate multi-gigabyte memory blocks. This can exhaust system memory resources, potentially leading to application crashes, degraded performance, or system instability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a malicious tar archive with an attacker-controlled entry size field that declares an extremely large size, causing memory exhaustion when processed by vulnerable Archive::Tar versions before 3.10.

Detection can involve inspecting tar files for unusually large declared entry sizes in their headers before extraction.

While no specific commands are provided in the resources, a practical approach is to analyze tar headers using tools like 'tar' with verbose or listing options, or custom scripts to parse the size fields in tar headers to identify entries with suspiciously large sizes.

For example, you can use the following command to list tar contents with sizes:

• tar -tvf suspicious_archive.tar

Then manually check for entries with abnormally large sizes that could indicate an exploit attempt.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Archive::Tar to version 3.10 or later, which includes a patch that limits the maximum allowed size for each tar entry to 1 GiB.

This patch prevents memory exhaustion by rejecting entries with declared sizes exceeding the limit before any memory allocation occurs.

Until the upgrade can be applied, avoid processing untrusted tar archives with vulnerable versions of Archive::Tar.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-9538 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0