CVE-2026-109380 in modern-tar
Summary
by MITRE • 10/13/2026
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in modern-tar versions 0.3.5 through 0.8.5 represents a critical flaw in the parsing logic of tar archives, specifically within the readOctal function responsible for interpreting numeric fields from archive headers. Tar files utilize an octal number format to store metadata such as file sizes, and this implementation fails to strictly validate that input bytes conform to valid octal digits before processing them. When non-octal characters are present in these fields, the parsing logic incorrectly interprets them, potentially resulting in negative integer values for entry sizes rather than throwing a validation error or handling the malformed data gracefully. This fundamental arithmetic misinterpretation bypasses standard size checks that would normally prevent excessive memory allocation based on file metadata.
The operational impact of this flaw is severe, leading to denial-of-service conditions through resource exhaustion. An attacker can craft a malicious tar archive, optionally compressed with gzip to evade basic content inspection or increase complexity, and supply it to the unpackTar function. Because the library interprets the crafted entry size as negative, it fails to apply upper bounds on memory allocation for buffering chunks of data. Instead of rejecting the invalid header, the process attempts to buffer these chunks indefinitely, causing continuous consumption of available system memory. This unbounded growth eventually exhausts the heap or virtual memory space allocated to the application, leading to a crash or significant performance degradation that renders the service unavailable to legitimate users.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-190, Integer Overflow or Wraparound, given the incorrect interpretation of numeric data types during parsing. The attack vector is consistent with ATT&CK technique T1496, Resource Hijacking, where an adversary uses computing resources to disrupt availability rather than compromising confidentiality or integrity directly. The specific mechanism involves exploiting a logic error in input validation that allows malformed metadata to trigger excessive resource allocation patterns within the decompression and extraction pipeline.
Mitigation strategies must focus on immediate patching of the modern-tar library to versions greater than 0.8.5, where this parsing flaw has been addressed with stricter type checking and bounds verification for octal fields. In environments where upgrading is not immediately feasible, defensive coding practices should be implemented at the application layer by validating archive integrity before passing it to the extraction routine. This includes implementing strict size limits on individual entries within an archive and rejecting any tar headers that contain non-standard characters in numeric fields. Additionally, deploying runtime protection mechanisms such as memory usage monitoring can help detect anomalous allocation patterns indicative of this exploitation attempt, allowing for automated termination of compromised processes before total system exhaustion occurs.