CVE-2026-54417: rxi microtar DOS Vulnerability

CVE-2026-54417 Overview

CVE-2026-54417 is an integer overflow vulnerability [CWE-190] in the mtar_next() function of src/microtar.c in rxi microtar 0.1.0. A remote attacker can supply a crafted tar archive that triggers a 32-bit arithmetic wrap when computing the offset to the next record. The wrap causes the parser to seek back to the current record, producing an infinite loop. Any application that iterates archive entries with mtar_next() or calls mtar_find() hangs at 100% CPU with no recovery path.

Critical Impact
A single malformed tar archive can pin a process at 100% CPU indefinitely, producing a denial of service in any service that parses untrusted archives with microtar.

Affected Products

rxi microtar version 0.1.0
Applications statically linking the vulnerable microtar.c source
Downstream projects embedding microtar for tar archive parsing

Discovery Timeline

2026-06-17 - CVE-2026-54417 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-54417

Vulnerability Analysis

The vulnerability resides in microtar's record advancement logic. mtar_next() computes the offset to the next tar record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic. When the header size field is a multiple of 512 in the range 0xFFFFFC01-0xFFFFFE00, the addition wraps around the 32-bit boundary to zero. The resulting seek does not advance the stream pointer past the current header.

Because mtar_find() and any user loop iterating entries depend on mtar_next() to progress, the parser revisits the same crafted record forever. The process consumes a full CPU core and never returns control to the caller. No memory corruption occurs, but availability of the parsing process is lost.

Root Cause

The root cause is unchecked 32-bit integer arithmetic on attacker-controlled values from the tar header. The size field is read from the archive without validation, then padded to a 512-byte boundary and added to the header size. The implementation does not detect or reject values that overflow the unsigned 32-bit accumulator, and it does not enforce a minimum forward progress of sizeof(mtar_raw_header_t) after each call.

Attack Vector

Exploitation requires the attacker to deliver a single crafted tar archive to a service or tool that parses it with microtar. The header size field is set to a 512-aligned value such as 0xFFFFFE00. When the target calls mtar_find() or iterates with mtar_next(), the offset calculation wraps and the parsing loop never terminates. The attack requires no authentication, no user interaction, and only network reachability to a service that ingests tar input. See the microtar source at line 239 for the affected calculation.

Detection Methods for CVE-2026-54417

Indicators of Compromise

Processes linked against microtar consuming 100% of a CPU core for an extended period after receiving a tar archive
Tar archives containing header size fields with values in the range 0xFFFFFC01-0xFFFFFE00, particularly 0xFFFFFE00
Application threads stuck in mtar_next() or mtar_find() call frames in stack traces or core dumps

Detection Strategies

Static analysis of ingested tar archives to flag header size fields exceeding the actual archive byte length
Runtime watchdog timers around microtar parsing calls that abort archives exceeding a parse-time budget
Sampling profilers and perf traces correlating sustained CPU utilization to the mtar_next symbol

Monitoring Recommendations

Alert on per-process CPU saturation that persists beyond expected parsing latency for archive-handling services
Log archive upload sizes and parse durations to identify outliers indicative of crafted inputs
Capture and inspect tar headers at ingress proxies before passing archives to vulnerable parsers

How to Mitigate CVE-2026-54417

Immediate Actions Required

Inventory all binaries and services that statically link rxi microtar 0.1.0 or vendor its microtar.c source
Apply input size and timeout controls in front of any service that parses tar archives from untrusted sources
Replace 32-bit arithmetic in the local copy of mtar_next() with checked 64-bit arithmetic that validates against archive length

Patch Information

No upstream patch is referenced in the NVD entry at the time of publication. Maintainers and downstream consumers should review the affected code at the rxi/microtar repository and apply a local fix that rejects header size values which would cause the offset computation to wrap or exceed the archive length.

Workarounds

Validate that round_up(h.size, 512) + sizeof(mtar_raw_header_t) does not overflow before seeking, using 64-bit operands
Reject any tar entry whose declared size exceeds the remaining bytes in the archive
Enforce a hard wall-clock and CPU time limit on archive parsing operations and terminate runaway parsers
Sandbox archive parsing in a separate process with a strict CPU cgroup to contain resource exhaustion

bash

# Example: enforce CPU and wall-clock limits on a tar-parsing helper using systemd-run
systemd-run --scope -p CPUQuota=50% -p RuntimeMaxSec=5 \
    /usr/local/bin/parse-archive /path/to/untrusted.tar