CVE-2022-2879: Unbounded memory consumption in archive/tar
Summary
CVE-2022-2879: Unbounded memory consumption when reading headers in archive/tar. Affects stdlib across 2 version ranges.
< 1.18.7
>= 1.19.0-0, < 1.19.2
Fixed in 1.18.7 or 1.19.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-2879 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides a set of standard libraries for various functionalities. One of these libraries is 'archive/tar', which allows reading and writing of tar archives. The 'archive/tar' package provides the Reader and Writer types for handling tar files. The Reader type is used to read files from a tar archive, while the Writer type is used to create tar archives. The vulnerability identified as CVE-2022-2879 affects the 'archive/tar' package in Go.
Vulnerability Detail
The vulnerability in 'archive/tar' arises from the Reader.Read function not setting a limit on the maximum size of file headers. This oversight allows a maliciously crafted tar archive to cause the Read function to allocate unbounded amounts of memory. This can lead to resource exhaustion or panics, potentially disrupting the functioning of the affected system. The vulnerability has been addressed in versions 1.18.7 and 1.19.2 of the Go stdlib, where the maximum size of header blocks is limited to 1 MiB.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.18.71.18.7go get stdlib@v1.18.7 -
>= 1.19.0-0, < 1.19.21.19.2go get stdlib@v1.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if updating the package is not immediately feasible, it is recommended to exercise caution when handling tar archives from untrusted sources. Avoid extracting or processing tar archives that are suspected to be malicious or excessively large.
Conclusion
The vulnerability in the 'archive/tar' package can be mitigated by updating to versions 1.18.7 or 1.19.2 of the Go stdlib. It is crucial to promptly address this vulnerability to prevent potential resource exhaustion or panics. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability allows a malicious tar archive to consume excessive memory, potentially leading to resource exhaustion or panics in the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your application without requiring any code or installation.
No, versions 1.18.7 and 1.19.2 of the Go stdlib have addressed this vulnerability. It is recommended to update to one of these versions to mitigate the risk.
Yes, if updating the package is not immediately feasible, exercise caution when handling tar archives from untrusted sources and avoid processing suspicious or excessively large archives.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2022-1037.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
