CVE-2026-9538 Denial of service in Archive::Tar

High 7.5 Published 26 May 2026 Updated 28 May 2026

Attackers can cause memory exhaustion and denial of service by crafting tar headers with excessively large size fields in the Perl Archive::Tar library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-9538?

CVE-2026-9538 is a high-severity denial of service vulnerability in BINGOS Archive::Tar, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.

_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.

A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.

Weakness: CWE-789

Which versions are affected by CVE-2026-9538?

It affects 1 product.

Linux distribution packages (40)

`perl-Archive-Tar` AlmaLinux:10	All versions	`3.02-512.el10_2.2`
`perl` AlmaLinux:8	All versions	`4:5.32.1-474.module_el8.10.0+4162+0aac7c4c`
`perl` AlmaLinux:8	All versions	`4:5.32.1-474.module_el8.10.0+4240+a58b978c`
`perl-Algorithm-Diff` AlmaLinux:8	All versions	`1.1903-10.module_el8.6.0+2766+8bf0b7ce`
`perl-Archive-Tar` AlmaLinux:8	All versions	`2.30-3.el8_10`
`perl-Archive-Tar` AlmaLinux:8	All versions	`2.38-5.module_el8.10.0+4240+a58b978c`
`perl-Archive-Zip` AlmaLinux:8	All versions	`1.68-3.module_el8.6.0+2766+8bf0b7ce`
`perl-Attribute-Handlers` AlmaLinux:8	All versions	`1.01-474.module_el8.10.0+4162+0aac7c4c`
`perl-AutoLoader` AlmaLinux:8	All versions	`5.74-474.module_el8.10.0+4162+0aac7c4c`
`perl-AutoSplit` AlmaLinux:8	All versions	`5.74-474.module_el8.10.0+4240+a58b978c`
`perl-B` AlmaLinux:8	All versions	`1.80-474.module_el8.10.0+4162+0aac7c4c`
`perl-B` AlmaLinux:8	All versions	`1.80-474.module_el8.10.0+4240+a58b978c`
`perl-Benchmark` AlmaLinux:8	All versions	`1.23-474.module_el8.10.0+4162+0aac7c4c`
`perl-CPAN` AlmaLinux:8	All versions	`2.28-5.module_el8.6.0+2766+8bf0b7ce`
`perl-CPAN-DistnameInfo` AlmaLinux:8	All versions	`0.12-13.module_el8.6.0+2766+8bf0b7ce`
`perl-CPAN-Meta` AlmaLinux:8	All versions	`2.150010-397.module_el8.6.0+2766+8bf0b7ce`
`perl-CPAN-Meta-Requirements` AlmaLinux:8	All versions	`2.140-397.module_el8.6.0+2766+8bf0b7ce`
`perl-CPAN-Meta-YAML` AlmaLinux:8	All versions	`0.018-1001.module_el8.6.0+2766+8bf0b7ce`
`perl-Carp` AlmaLinux:8	All versions	`1.50-439.module_el8.6.0+2766+8bf0b7ce`
`perl-Class-Struct` AlmaLinux:8	All versions	`0.66-474.module_el8.10.0+4162+0aac7c4c`
`perl-Compress-Bzip2` AlmaLinux:8	All versions	`2.28-2.module_el8.6.0+2766+8bf0b7ce`
`perl-Compress-Bzip2` AlmaLinux:8	All versions	`2.28-2.module_el8.6.0+3181+91434291`
`perl-Compress-Raw-Bzip2` AlmaLinux:8	All versions	`2.096-1.module_el8.6.0+2766+8bf0b7ce`
`perl-Compress-Raw-Bzip2` AlmaLinux:8	All versions	`2.096-1.module_el8.6.0+3181+91434291`
`perl-Compress-Raw-Lzma` AlmaLinux:8	All versions	`2.096-1.module_el8.6.0+2766+8bf0b7ce`
`perl-Compress-Raw-Lzma` AlmaLinux:8	All versions	`2.096-1.module_el8.6.0+3181+91434291`
`perl-Compress-Raw-Zlib` AlmaLinux:8	All versions	`2.096-2.module_el8.10.0+3779+d5938d28`
`perl-Config-Extensions` AlmaLinux:8	All versions	`0.03-474.module_el8.10.0+4240+a58b978c`
`perl-Config-Perl-V` AlmaLinux:8	All versions	`0.32-441.module_el8.6.0+2766+8bf0b7ce`
`perl-DBM_Filter` AlmaLinux:8	All versions	`0.06-474.module_el8.10.0+4162+0aac7c4c`
`perl-DB_File` AlmaLinux:8	All versions	`1.855-1.module_el8.6.0+2766+8bf0b7ce`
`perl-DB_File` AlmaLinux:8	All versions	`1.855-1.module_el8.6.0+3181+91434291`
`perl-Data-Dumper` AlmaLinux:8	All versions	`2.174-440.module_el8.6.0+2766+8bf0b7ce`
`perl-Data-Dumper` AlmaLinux:8	All versions	`2.174-440.module_el8.6.0+3181+91434291`
`perl-Data-OptList` AlmaLinux:8	All versions	`0.110-7.module_el8.6.0+2766+8bf0b7ce`
`perl-Data-Section` AlmaLinux:8	All versions	`0.200007-8.module_el8.6.0+2766+8bf0b7ce`
`perl-Devel-PPPort` AlmaLinux:8	All versions	`3.62-1.module_el8.6.0+2766+8bf0b7ce`
`perl-Devel-PPPort` AlmaLinux:8	All versions	`3.62-1.module_el8.6.0+3181+91434291`
`perl-Devel-Peek` AlmaLinux:8	All versions	`1.28-474.module_el8.10.0+4162+0aac7c4c`
`perl-Devel-Peek` AlmaLinux:8	All versions	`1.28-474.module_el8.10.0+4240+a58b978c`

Products include Archive\ \.

How do I fix CVE-2026-9538?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-9538 being exploited?

There is no known exploitation of CVE-2026-9538 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:48225, ALSA-2026:49523, ALSA-2026:49524, ALSA-2026:49525, BELL-CVE-2026-9538, CLSA-2026-1786095908 and 16 more.