Golang Archive/Tar Unbounded Memory Allocation Vulnerability

A vulnerability exists in the Golang standard library's archive/tar package, specifically in versions prior to 1.25.9 and from 1.26.0 up to but not including 1.26.2. The issue arises in tar.Reader, which can allocate an unbounded amount of memory when processing a maliciously crafted archive. This archive contains a large number of sparse regions encoded in the 'old GNU sparse map' format, leading to potential memory exhaustion.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by allowing a crafted archive to consume excessive amounts of memory, potentially leading to application or system resource exhaustion.

Remediation

Users can upgrade to Golang versions 1.25.9 or 1.26.2 to address this vulnerability.