{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109380", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-12T14:23:25.691Z", "datePublished": "2026-10-12T20:55:11.774Z", "dateUpdated": "2026-10-12T20:55:11.774Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-12T20:55:11.774Z"}, "datePublic": "2026-10-08T00:00:00.000Z", "title": "modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field", "descriptions": [{"lang": "en", "value": "modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Validation of Specified Quantity in Input", "cweId": "CWE-1284", "type": "CWE"}]}], "affected": [{"vendor": "ayuhito", "product": "modern-tar", "defaultStatus": "unaffected", "versions": [{"version": "0.3.5", "status": "affected", "versionType": "semver", "lessThanOrEqual": "0.8.5"}], "packageURL": "pkg:npm/modern-tar", "repo": "https://github.com/ayuhito/modern-tar"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/ayuhito/modern-tar/pull/195", "tags": ["issue-tracking", "patch"], "name": "GitHub Pull Request #195"}, {"url": "https://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90fe416e", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts", "tags": ["technical-description"], "name": "Vulnerable code in encoding.ts"}, {"url": "https://github.com/ayuhito/modern-tar", "tags": ["product"]}, {"name": "VulnCheck Advisory: modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhaustion-via-malformed-octal-size-field"}], "credits": [{"lang": "en", "value": "Lum Humolli", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/modern-tar", "product": "modern-tar", "repo": "https://github.com/ayuhito/modern-tar", "vendor": "ayuhito", "versions": [{"lessThanOrEqual": "0.8.5", "status": "affected", "version": "0.3.5", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries."}], "id": "CVE-2026-109380", "lastModified": "2026-10-12T21:17:11.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-12T21:17:11.153", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/ayuhito/modern-tar"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90fe416e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ayuhito/modern-tar/pull/195"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhaustion-via-malformed-octal-size-field"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "modern-tar: modern-tar: Denial of Service via memory exhaustion from crafted archives", "id": "2549954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2549954"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in modern-tar. A remote attacker can trigger a Denial of Service (DoS) by supplying a specially crafted archive containing malformed entry size values. When processing the invalid data, the parser fails to properly calculate file sizes and buffers data indefinitely, leading to memory exhaustion and process termination."], "name": "CVE-2026-109380", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-12T20:55:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109380\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109380\nhttps://github.com/ayuhito/modern-tar\nhttps://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts\nhttps://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90fe416e\nhttps://github.com/ayuhito/modern-tar/pull/195\nhttps://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhaustion-via-malformed-octal-size-field"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.3.5,0.8.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "modern-tar", "source": "cna", "vendor": "ayuhito"}, "product": "modern-tar", "vendor": "ayuhito"}], "created": "2026-10-12T23:00:10.068738+00:00", "updated": "2026-10-13T07:25:17.118785+00:00", "vendors": ["ayuhito", "ayuhito$PRODUCT$modern-tar"]}