CVE-2026-109380
7.5 HIGHpublic exploit availablePublished 2026-10-12 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1284
Public exploit & PoC references
All references
- https://github.com/ayuhito/modern-tar
- https://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts
- https://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90fe416e
- https://github.com/ayuhito/modern-tar/pull/195
- https://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhaustion-via-malformed-octal-size-field
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-36178
- MEDIUMCVE-2026-101985
- MEDIUMCVE-2026-101995
- HIGHCVE-2026-102016
- MEDIUMCVE-2026-102019
- MEDIUMCVE-2026-102033
- HIGHCVE-2026-102065
- MEDIUMCVE-2026-102067
Related by shared AI tags and CWE weakness class. Browse the full archive.