CVE-2026-32288 Unbounded allocation for old GNU sparse in archive/tar
An attacker can cause a denial of service by forcing the Go tar reader to allocate excessive memory via a malicious archive.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-32288?
CVE-2026-32288 is a medium-severity denial of service vulnerability in Golang Go, published on 8 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
Weakness: CWE-770
Which versions are affected by CVE-2026-32288?
2 open source packages ship an affected version, including golang and stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.25.9, 1.26.2 |
stdlib Go | All versions | 1.25.9, 1.26.2 |
Products include Golang Go.
How do I fix CVE-2026-32288?
Upgrade golang to a fixed version for your release line: 1.25.9 or 1.26.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-32288 being exploited?
There is no known exploitation of CVE-2026-32288 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-82091, AZL-82169, AZL-82292, AZL-82458, AZL-82608, AZL-98661 and 647 more.