Bug 2498116 (CVE-2026-59874)
| Summary: | CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abarbaro, abrianik, akostadi, alizardo, amasferr, anthomas, anujha, aruklets, aschwart, asoldano, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, bstansbe, cdrage, cmah, dbruscin, dfreiber, dlofthou, dmayorov, doconnor, drichtar, drow, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, ehugonne, fmariani, ggainey, ggrzybek, gmalinko, gparvin, ibolton, istudens, ivassile, iweiss, janstey, jburrell, jchui, jhe, jlanda, jlledo, jmatthew, jmontleo, jolong, jpasqual, jraez, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, manissin, mcarlett, mhulan, mosmerov, mposolda, mstipich, msvehla, nboldt, ngough, nmoumoul, nwallace, oaljalju, osousa, pantinor, parichar, pberan, pcreech, pesilva, pgaikwad, pjindal, pmackay, psrna, rchan, rekumar, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rmartinc, rstancel, rstepani, rushinde, sdawley, sfeifer, simaishi, slucidi, smallamp, sseago, ssilvert, stcannon, sthirugn, sthorger, tasato, tcunning, teagle, thjenkin, tmalecek, tsedmik, vdosoudi, veshanka, vkumar, vmuzikar, vvoronko, watson-tool-maintainers, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2498790, 2498791, 2498792, 2498795, 2498797, 2498799, 2498802, 2498803, 2498804, 2498793, 2498794, 2498796, 2498798, 2498800, 2498801 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-07-08 16:01:33 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:47060 https://access.redhat.com/errata/RHSA-2026:47060 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:47059 https://access.redhat.com/errata/RHSA-2026:47059 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:47057 https://access.redhat.com/errata/RHSA-2026:47057 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:47058 https://access.redhat.com/errata/RHSA-2026:47058 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:48034 https://access.redhat.com/errata/RHSA-2026:48034 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:48033 https://access.redhat.com/errata/RHSA-2026:48033 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:52399 https://access.redhat.com/errata/RHSA-2026:52399 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:53298 https://access.redhat.com/errata/RHSA-2026:53298 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:57590 https://access.redhat.com/errata/RHSA-2026:57590 This issue has been addressed in the following products: Red Hat AMQ Broker 7.14.1 Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488 This issue has been addressed in the following products: Red Hat AMQ Broker 7.13.6 Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545 |