CVE-2026-9538
Publication date 26 May 2026
Last updated 27 August 2026
Ubuntu priority
Description
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| perl | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Fixed 5.38.2-3.2ubuntu0.4
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.5 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8684-1
- Perl vulnerabilities
- 27 August 2026
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-9538
- https://lists.security.metacpan.org/cve-announce/msg/40396448/
- https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch
- https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes
- http://www.openwall.com/lists/oss-security/2026/05/26/4