Critical Vulnerability in perl-Archive-Tar: Denial of Service via Crafted Tar Header
Summary
RLSA-2026:49524: Important: perl-Archive-Tar security update. Affects perl-Archive-Tar versions < 0:2.30-3.el8_10. Fixed in 0:2.30-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
perl-Archive-Tar is a Perl module that provides an object-oriented interface for handling tar files. It allows users to create, manipulate, and extract tar archives easily. The module also supports compressed tar files when the IO::Zlib module is present. However, a recent security issue has been identified that could lead to a Denial of Service (DoS) if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2026-9538, arises from the handling of crafted tar headers with large entry sizes. An attacker could create a specially crafted tar file that, when processed by the perl-Archive-Tar module, could cause excessive resource consumption, leading to a Denial of Service. This could disrupt services relying on the module, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
0:2.30-3.el8_10
This is the first release that contains the fix.
sudo dnf update perl-Archive-TarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider restricting access to the functionality that processes tar files or implementing input validation to reject suspicious tar files until the update can be applied.
Conclusion
The perl-Archive-Tar module has a critical vulnerability that can lead to Denial of Service if exploited. It is essential to update to the latest patched version to protect your applications. If immediate updates are not feasible, consider implementing workarounds to minimize risk.
See every vulnerability recorded for perl-Archive-Tar →
FAQ
CVE-2026-9538 is a vulnerability in the perl-Archive-Tar module that can lead to a Denial of Service due to crafted tar headers with large entry sizes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability could lead to excessive resource consumption, causing applications that rely on perl-Archive-Tar to become unresponsive.
Yes, a patch is available. You should update to version 0:2.30-3.el8_10 or later to mitigate the risk.
If immediate updating is not possible, restrict access to the tar processing functionality and implement input validation to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for perl-Archive-Tar.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
