{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amodern-tar_projectmodern-tar0.8.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:modern-tar_project:modern-tar:0.3.5:*:*:*:*:*:*:*","cpe:2.3:a:modern-tar_project:modern-tar:0.8.5:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109380"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["modern-tar (0.3.5-0.8.5)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe modern-tar library, specifically versions 0.3.5 through 0.8.5, contains a memory exhaustion vulnerability (CVE-2026-109380) that impacts applications utilizing the library to unpack archives. The vulnerability exists within the readOctal() function, which fails to correctly sanitize non-octal bytes during input parsing. An attacker can exploit this flaw by providing a maliciously crafted, optionally gzip-compressed archive to the unpackTar() function. This input causes the parser to calculate negative entry sizes, leading the process to buffer data chunks indefinitely. The resulting memory exhaustion results in a denial-of-service condition for the affected application and prevents the processing of subsequent entries in the archive. Defenders should identify applications using these versions of modern-tar and upgrade to a patched release once available to mitigate the risk of service interruption.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in an application-level denial-of-service. By inducing memory exhaustion, attackers can crash service components that handle archive processing, impacting system availability for users of the vulnerable software. The impact is primarily restricted to availability and does not typically involve code execution or unauthorized data access based on currently available information.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all internal and vendor-supplied software dependencies utilizing modern-tar versions 0.3.5 through 0.8.5.\u003c/li\u003e\n\u003cli\u003eUpdate identified software to a non-vulnerable version of modern-tar as soon as patches are released by the maintainers.\u003c/li\u003e\n\u003cli\u003eImplement resource limits (ulimit or container resource quotas) on processes responsible for parsing untrusted user-supplied archives to minimize the impact of potential memory exhaustion attacks.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for unexpected process restarts or memory-related crashes associated with archive processing functionality.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:41:39Z","date_published":"2026-10-12T22:41:39Z","id":"https://feed.craftedsignal.io/briefs/2026-10-modern-tar-memory-exhaustion/","summary":"The modern-tar library versions 0.3.5 through 0.8.5 are susceptible to a memory exhaustion denial-of-service vulnerability triggered by crafted, compressed archives.","title":"Memory Exhaustion Vulnerability in modern-tar","url":"https://feed.craftedsignal.io/briefs/2026-10-modern-tar-memory-exhaustion/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:modern-Tar_project:modern-Tar:0.8.5:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}