Unbounded memory consumption when reading headers in archive/tar
Priority LOW 37CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 20 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
Why it matters now
EPSS 0.02006 80th percentileScored 2026-11-07
Fix Partial archive/tar (Go standard library): 1.18.7, 1.19.2Red Hat: 25 advisoriesRed Hat: 20 fixed, 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | archive/tar | before 1.18.7; 1.19.0-0 to before 1.19.2 | 1.18.7, 1.19.2 | Patch available | CNA |
- archive/tar VendorGo standard library Affected before 1.18.7; 1.19.0-0 to before 1.19.2 Fixed in 1.18.7, 1.19.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.18.7; 1.19.0 to before 1.19.2 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.18.7; 1.19.0 to before 1.19.2 Vulnerable ·Go standard library
Remediation
- Fix · CNA archive/tar (Go standard library) Fixed in 1.18.7, 1.19.2
Red Hat 25 advisories
- RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47
- RHSA-2024:2944 Released 2024-05-21 · Red Hat rating ImportantAMQ Broker 7.12.0.OPR.1.GA Container Images release and security update
- Middleware Containers for OpenShift amq7/amq-broker-init-rhel8, amq7/amq-broker-rhel8, amq7/amq-broker-rhel8-operator +1
- RHSA-2024:0121 Released 2024-01-10 · Red Hat rating Moderatecontainer-tools:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20656+56f336b9.s390x::container-tools:4.0 +47
Show 22 more Red Hat advisories
- RHSA-2023:4003 Released 2023-07-10 · Red Hat rating ModerateRed Hat Service Interconnect 1.4 Release security update
- Red Hat Service Interconnect skupper-cli-1.4.1-2.el8, skupper-router-2.4.1-2.el8, skupper-router-common-2.4.1-2.el8 +2
- Red Hat Service Interconnect 1 skupper-cli-1.4.1-2.el9, skupper-router-2.4.1-2.el9, skupper-router-common-2.4.1-2.el9 +2
- RHSA-2023:3613 Released 2023-06-26 · Red Hat rating ModerateOpenShift Container Platform 4.12.22 packages and security update
- Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
- RHSA-2023:3205 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:2780 Released 2023-05-16 · Red Hat rating ModerateImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-75-1.el8, osbuild-composer-core-75-1.el8, osbuild-composer-dnf-json-75-1.el8 +2
- RHSA-2023:2204 Released 2023-05-09 · Red Hat rating ModerateImage Builder security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-76-2.el9_2, osbuild-composer-core-76-2.el9_2, osbuild-composer-dnf-json-76-2.el9_2 +2
- RHSA-2023:1174 Released 2023-03-09 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.2 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
- RHSA-2023:1042 Released 2023-03-06 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat OpenShift (with security updates)
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator
- RHSA-2023:1079 Released 2023-03-06 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2 (osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container) security update
- Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
- RHSA-2023:0727 Released 2023-02-16 · Red Hat rating ModerateOpenShift Container Platform 4.12.3 security update
- Red Hat OpenShift Container Platform 4.12 buildah-1:1.23.4-4.rhaos4.12.el8, buildah-1:1.23.4-4.rhaos4.12.el9, buildah-tests-1:1.23.4-4.rhaos4.12.el8 +45
- RHSA-2023:0709 Released 2023-02-09 · Red Hat rating ModerateRelease of OpenShift Serverless 1.27.0
- Red Hat OpenShift Serverless 1.27 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8, openshift-serverless-1/client-kn-rhel8 +34
- RHSA-2023:0708 Released 2023-02-09 · Red Hat rating ModerateRelease of OpenShift Serverless Client kn 1.27.0
- Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.6.1-1.el8
- RHSA-2023:0693 Released 2023-02-09 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
- RHSA-2023:0542 Released 2023-01-30 · Red Hat rating ImportantRed Hat OpenShift Service Mesh 2.3.1 Containers security update
- RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4
- RHSA-2023:0446 Released 2023-01-25 · Red Hat rating Moderatego-toolset:rhel8 security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.src::go-toolset:rhel8, delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.x86_64::go-toolset:rhel8, go-toolset-1.18.9-1.module+el8.7.0+17845+708ebe87.aarch64::go-toolset:rhel8 +18
- RHSA-2023:0445 Released 2023-01-25 · Red Hat rating Moderatego-toolset-1.18 security update
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.18-1.18.9-1.el7_9, go-toolset-1.18-build-1.18.9-1.el7_9, go-toolset-1.18-golang-1.18.9-1.el7_9 +8
- Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.18-1.18.9-1.el7_9, go-toolset-1.18-build-1.18.9-1.el7_9, go-toolset-1.18-golang-1.18.9-1.el7_9 +8
- RHSA-2023:0328 Released 2023-01-23 · Red Hat rating Moderatego-toolset and golang security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) golang-1.18.9-1.el9_1, golang-bin-1.18.9-1.el9_1, golang-docs-1.18.9-1.el9_1 +4
- RHSA-2023:0264 Released 2023-01-19 · Red Hat rating ModerateRed Hat OpenShift (Logging Subsystem) security update
- RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
- RHSA-2022:7399 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:7398 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
- Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
- RHSA-2022:8781 Released 2022-12-08 · Red Hat rating ModerateLogging Subsystem 5.5.5 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-operator-bundle, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +3
- RHSA-2022:8535 Released 2022-11-24 · Red Hat rating ModerateOpenShift Container Platform 4.11.16 security update
- Red Hat OpenShift Container Platform 4.11 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 3 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| 8Base-OADP-1.1 | Fixed | RHSA-2023:1174 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:0693 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:3205 |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:2944 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2023:1042 |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| RHOL 5.5 for RHEL 8 | Fixed | RHSA-2022:8781 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2023:0264 |
| RHOSSM 2.3 for RHEL 8 | Fixed | RHSA-2023:0542 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:0445 |
| Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:0445 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:0446, RHSA-2023:2780, RHSA-2024:0121, RHSA-2024:2988 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:0328, RHSA-2023:2204 |
| Red Hat OpenShift Container Platform 4.11 | Fixed | RHSA-2022:8535 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7398, RHSA-2022:7399, RHSA-2023:0727, RHSA-2023:3613 |
| Red Hat OpenShift Serverless 1.0 | Fixed | RHSA-2023:0708 |
| Red Hat OpenShift Serverless 1.27 | Fixed | RHSA-2023:0709 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2023:1079 |
| Red Hat Service Interconnect | Fixed | RHSA-2023:4003 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2023:4003 |
Not affected: 17 products
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- Ironic content for Red Hat OpenShift Container Platform 4.12
- Middleware Containers for OpenShift
- OpenShift Custom Metrics Autoscaler 2
- RHODF 4.13 for RHEL 9
- RHOL 5.5 for RHEL 8
- RHOL 5.6 for RHEL 8
- RHOSSM 2.3 for RHEL 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat Service Interconnect
- Red Hat Service Interconnect 1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2879
- 2026-10-03 Alias added: GHSA-fqpx-62jv-7r6r
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-2879 · CVE Program
- CVE-2022-2879 · NVD
- FIRST EPSS
- GHSA-fqpx-62jv-7r6r · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2879 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences