Critical Denial of Service Vulnerability in perl-Archive-Tar Package
Summary
ALSA-2026:49523: Important: perl-Archive-Tar security update. Affects perl-Archive-Tar versions < 3.02-512.el10_2.2. Fixed in 3.02-512.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Archive-Tar is a Perl module that provides an object-oriented interface for handling tar files. It simplifies file management and allows users to create tar file objects for custom manipulation. The module also supports compressed tar files when the IO::Zlib module is installed. However, it has been found to be vulnerable to a Denial of Service (DoS) attack due to improper handling of crafted tar headers, which can lead to large entry sizes.
Vulnerability Detail
The vulnerability identified as CVE-2026-9538 allows an attacker to exploit the perl-Archive-Tar package by crafting a tar header with a large entry size. This can lead to a Denial of Service condition, where the application becomes unresponsive or crashes, impacting the availability of services that rely on this package. The issue arises from inadequate validation of tar header sizes, making it possible for malicious users to disrupt normal operations.
How To Fix
Minimum fixed version
3.02-512.el10_2.2
This is the first release that contains the fix.
sudo dnf update perl-Archive-TarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the perl-Archive-Tar module in your applications until the package is updated. Additionally, consider implementing input validation to check the size of tar headers before processing them.
Conclusion
The perl-Archive-Tar package has a critical vulnerability (CVE-2026-9538) that can lead to Denial of Service attacks. It is essential to update to the patched version to mitigate risks. Users should also consider temporary workarounds while preparing for the update.
See every vulnerability recorded for perl-Archive-Tar →
FAQ
CVE-2026-9538 is a vulnerability in the perl-Archive-Tar package that allows for Denial of Service attacks through crafted tar headers.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The primary consequence is a Denial of Service, which can render your application unresponsive and disrupt services relying on the perl-Archive-Tar package.
Yes, a patch is available in version 3.02-512.el10_2.2 of the perl-Archive-Tar package.
If immediate updates are not possible, consider implementing input validation and restricting the use of the affected module as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Archive-Tar.
