CVE-2022-2879

CVE-2022-2879: vulnerability in Go standard library archive/tar

Unbounded memory consumption when reading headers in archive/tar

Published · Updated

Follow this CVE+ Monitor archive/tar+ Monitor go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.0%
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Affected products
Go standard library · archive/tar
Related CVEs — Go standard library archive/tar

In the same product, most dangerous first.

CVE-2025-58183MEDIUMUnbounded allocation when parsing GNU sparse map in archive/tarEPSS 0.4%CVE-2026-32288MEDIUMUnbounded allocation for old GNU sparse in archive/tarEPSS 0.3%