VULNERABILITY INTELLIGENCE

CVE-2026-32288

CVSS score5.5 MEDIUM

EPSS probability0.29%

CISA KEVNot currently listed

Published2026-04-08

Last modified2026-07-25

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Weakness classification

nvd@nist.gov: CWE-770

Primary references

security@golang.org — Patch
security@golang.org — Issue Tracking
security@golang.org — Mailing List, Release Notes
security@golang.org — Vendor Advisory