CVE-2026-9538: Archive::Tar Perl DOS Vulnerability

CVE-2026-9538 Overview

CVE-2026-9538 is a memory exhaustion vulnerability in the Perl Archive::Tar module before version 3.10. The flaw resides in the _read_tar() routine, which reads each entry's payload using $handle->read($$data, $block). The $block value is taken directly from the 12-byte size field in the tar header without an upper bound check. An attacker who supplies a crafted tar archive can declare a multi-gigabyte entry size, causing Perl to allocate a scalar of that declared size and exhaust available memory. The issue is classified under [CWE-789: Memory Allocation with Excessive Size Value].

Critical Impact
A single crafted tar archive parsed by Archive::Tar can trigger uncontrolled memory allocation, leading to denial of service of the affected Perl process or host.

Affected Products

Archive::Tar for Perl, all versions prior to 3.10
Perl applications and toolchains that consume untrusted tar archives through Archive::Tar
Distributions and CPAN-based pipelines bundling vulnerable Archive::Tar releases

Discovery Timeline

2026-05-26 - CVE-2026-9538 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9538

Vulnerability Analysis

The vulnerability is a memory exhaustion denial of service triggered during tar header parsing. Archive::Tar parses each entry header, extracts the 12-byte ASCII octal size field, converts it to an integer, and uses that value as the read length for the payload buffer. Because the implementation performed no sanity check against the actual archive size or any configurable ceiling, a header declaring a size of several gigabytes forces Perl to pre-allocate a scalar of that length. The allocation occurs before any payload data is consumed, so the attack succeeds even if the archive itself is only a few hundred bytes on disk. The result is process termination through out-of-memory conditions, system-wide memory pressure, or invocation of the operating system's OOM killer against unrelated processes.

Root Cause

The root cause is missing input validation on an attacker-controlled length field. _read_tar() trusted the size value derived from the tar header and passed it directly to a buffered read without comparing it to the remaining file size or a configured maximum. The fix introduces a new package variable, $MAX_FILE_SIZE, that bounds the declared entry size during reads.

Attack Vector

Exploitation requires no authentication and no user interaction beyond passing an attacker-supplied tar file to any code path that uses Archive::Tar. Common vectors include backup utilities, package managers, CI/CD pipelines, web upload handlers, and email or file-scanning agents that unpack tar archives automatically.

text

 use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD
             $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS
             $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @ISA @EXPORT $RESOLVE_SYMLINK
-            $EXTRACT_BLOCK_SIZE $EXTRACT_HARDLINK
+            $EXTRACT_BLOCK_SIZE $EXTRACT_HARDLINK $MAX_FILE_SIZE
          ];

 @ISA                    = qw[Exporter];

Source: GitHub Patch Commit f9af014. The patch adds a new $MAX_FILE_SIZE global used to cap the entry size honored during reads in lib/Archive/Tar.pm.

Detection Methods for CVE-2026-9538

Indicators of Compromise

Perl processes terminated by the operating system's OOM killer shortly after invoking Archive::Tar against an external archive
Sudden spikes in resident memory usage by perl interpreters parsing tar files from untrusted sources
Tar archives whose declared header sizes vastly exceed the on-disk file size

Detection Strategies

Inspect tar files at ingress by comparing each entry's declared size field against the total archive size and flagging headers that declare multi-gigabyte payloads in small archives
Inventory installed Perl modules across hosts and identify systems running Archive::Tar below version 3.10
Review application code for callers of Archive::Tar::read, Archive::Tar->new, and extract_archive that operate on attacker-influenced inputs

Monitoring Recommendations

Alert on Perl processes whose memory consumption grows sharply within seconds of opening a file descriptor on a .tar, .tgz, or .tar.gz artifact
Monitor kernel logs for oom-killer events targeting perl and correlate with archive-handling services
Track CPAN and OS package update events to confirm Archive::Tar 3.10 or later is deployed

How to Mitigate CVE-2026-9538

Immediate Actions Required

Upgrade Archive::Tar to version 3.10 or later on every host, container image, and CI runner that processes tar archives
Audit applications that accept user-supplied archives and restrict the source of tar files until patching is complete
Rebuild and redeploy container images and Perl distributions that bundle the vulnerable module

Patch Information

The fix is delivered in Archive::Tar 3.10. See the MetaCPAN Release Changes and the upstream GitHub Patch Commit. The patch introduces the $MAX_FILE_SIZE package variable that bounds the entry size honored during reads. Additional context is published in the OpenWall OSS Security Post.

Workarounds

If upgrading is not immediately possible, set $Archive::Tar::MAX_FILE_SIZE to a conservative ceiling in calling code once the patched module is in place
Apply per-process memory limits using ulimit -v or systemd MemoryMax= directives on services that parse untrusted tar archives
Pre-validate archives with an external tool that rejects entries whose header size exceeds the actual file size

bash

# Configuration example: upgrade Archive::Tar and enforce a memory ceiling
cpanm Archive::Tar@3.10

# Cap memory for a Perl service that processes tar archives
systemctl edit my-tar-service
# In the override file:
# [Service]
# MemoryMax=512M

# In Perl code (after upgrading to 3.10+):
# use Archive::Tar;
# $Archive::Tar::MAX_FILE_SIZE = 256 * 1024 * 1024;  # 256 MiB ceiling