Critical Denial of Service Vulnerability in perl-Archive-Tar Package
Summary
ALSA-2026:49524: Important: perl-Archive-Tar security update. Affects perl-Archive-Tar versions < 2.30-3.el8_10. Fixed in 2.30-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-Archive-Tar is a Perl module that provides an object-oriented interface for handling tar files. It simplifies the process of creating, manipulating, and extracting tar archives, including support for compressed files when the IO::Zlib module is present. This package is widely used in various applications for file archiving and distribution, making its security crucial for maintaining system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2026-9538 allows for a Denial of Service (DoS) attack through a crafted tar header that contains a large entry size. This flaw can be exploited by an attacker to create a specially crafted tar file that, when processed by the perl-Archive-Tar module, can cause the application to hang or crash. The impact of this vulnerability can lead to service disruptions and potential data loss, making it critical for users of the package to address it promptly.
How To Fix
Minimum fixed version
2.30-3.el8_10
This is the first release that contains the fix.
sudo dnf update perl-Archive-TarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted tar files or implement additional validation checks before handling tar archives to mitigate the risk of exploitation until the package is updated.
Conclusion
The perl-Archive-Tar package has a critical vulnerability (CVE-2026-9538) that can lead to Denial of Service attacks. Users are strongly advised to update to the latest patched version to secure their applications. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for perl-Archive-Tar →
FAQ
CVE-2026-9538 is a security vulnerability in the perl-Archive-Tar package that allows for Denial of Service attacks via crafted tar headers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to application crashes and service disruptions, affecting the availability of your software.
Yes, the patched version of perl-Archive-Tar is 2.30-3.el8_10. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, avoid processing untrusted tar files and implement additional validation checks as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Archive-Tar.
