Critical Security Flaw in Perl Package: Denial of Service via Archive-Tar Header
Summary
ALSA-2026:48225: Important: perl:5.32 security update. Affects perl across 2 version ranges.
< 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
< 4:5.32.1-474.module_el8.10.0+4240+a58b978c
Fixed in 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c or 4:5.32.1-474.module_el8.10.0+4240+a58b978c, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Perl is a high-level programming language widely used for system administration, web development, and network programming. It is known for its flexibility and extensive library support. The Archive-Tar module, a part of Perl's ecosystem, is utilized for handling tar archives. Recently, a vulnerability was discovered that allows attackers to exploit this module, leading to potential Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-9538, arises from the Archive-Tar module's inability to properly handle crafted tar headers with excessively large entry sizes. This flaw can be exploited by an attacker to create a specially crafted tar file that, when processed by the Archive-Tar module, can cause the application to hang or crash, resulting in a Denial of Service. The impact of this vulnerability is significant, as it can disrupt services relying on Perl applications that utilize the Archive-Tar module.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update perl-
< 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c4:5.32.1-474.module_el8.10.0+4162+0aac7c4c -
< 4:5.32.1-474.module_el8.10.0+4240+a58b978c4:5.32.1-474.module_el8.10.0+4240+a58b978c
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted tar files with the Archive-Tar module until the package is updated. If possible, implement input validation to reject any tar files that exceed expected size limits.
Conclusion
The vulnerability in the Perl Archive-Tar module poses a significant risk of Denial of Service attacks. It is crucial for users to update their packages to the latest patched versions to ensure the security of their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for perl →
FAQ
CVE-2026-9538 is a vulnerability in the Perl Archive-Tar module that allows attackers to exploit crafted tar headers, leading to Denial of Service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to service disruptions, as applications may hang or crash when processing malicious tar files.
Yes, a patch is available. Updating the perl-Archive-Tar package to version 2.38-5.module_el8.10.0+4240+a58b978c or later will resolve the issue.
If immediate updates are not possible, avoid processing untrusted tar files and implement input validation to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for perl.
