Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-109380: modern-tar may run out of memory when opening bad archive
CVE-2026-109380 · published 23 days ago
Summary
The modern-tar library (versions 0.3.5 through 0.8.5) can be tricked by a specially crafted archive file into using all of a computer's memory, which stops the program from working correctly. This happens because the file can contain incorrect size information that the program does not handle properly. Upgrade to a newer version of modern-tar or avoid extracting archives from untrusted sources.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ayuhito | modern-tar | <= 0.8.5 |
Original advisory text
modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
References
- https://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhau... Vendor Advisory
- https://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90f... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1093... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109380 Vendor Advisory
- https://github.com/ayuhito/modern-tar Product
- https://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts Third Party Advisory
- https://github.com/ayuhito/modern-tar/pull/195 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published12 Oct 2026
Updated4 Nov 2026
First seen12 Oct 2026
Track software like this
Free during beta