CVE-2026-32288 json
Unbounded allocation for old GNU sparse in archive/tar
published 2026-04-07 7 mo ago modified 2026-10-07 33 d ago also BIT-golang-2026-32288 , EUVD-2026-20016 , GO-2026-4869
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
Patch / fix
- bitnami golang 1.25.9, 1.26.2
- go stdlib 1.25.9, 1.26.2
- Go standard library archive/tar 1.25.9, 1.26.2
- golang-1.26 Debian 14 1.26.2-1
debian advisories DEBIAN-CVE-2026-32288
- delve RHEL 8 1.25.2-1.module+el8.10.0+23746+9db33b5e
- golang RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- go-toolset RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-bin RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-src RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-misc RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-race RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
- golang-tests RHEL 8 1.25.10-1.module+el8.10.0+24308+5c4a16b7
red hat advisories RHSA-2026:22112RHSA-2026:7385RHSA-2026:7291RHSA-2026:10217RHSA-2026:10219
- go1.25-openssl SLES for SAP applications 16.0, SLES 16.0 1.25.12-160000.1.1
- go1.26-openssl SLES for SAP applications 16.0, SLES 16.0 1.26.4-160000.1.1
- go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.25.9-150000.1.21.1
- go1.26-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.26.2-150000.1.6.1
- go1.25 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.25.9-150000.1.35.1
- go1.26 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 1.26.2-150000.1.9.1
suse advisories SUSE-SU-2026:22638-1SUSE-SU-2026:22572-1SUSE-SU-2026:1581-1SUSE-SU-2026:1580-1SUSE-SU-2026:1321-1SUSE-SU-2026:1320-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- go1.25-openssl openSUSE Leap 16.0 1.25.12-160000.1.1
- go1.26-openssl openSUSE Leap 16.0 1.26.4-160000.1.1
- go1.26 openSUSE Leap 16.0 1.26.2-160000.1.1
- go1.25 openSUSE Leap 16.0 1.25.9-160000.1.1
- go1.26 openSUSE Tumbleweed 1.26.2-1.1
- go1.25 openSUSE Tumbleweed 1.25.9-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21319-1openSUSE-SU-2026:21254-1openSUSE-SU-2026:20571-1openSUSE-SU-2026:20570-1openSUSE-SU-2026:10525-1
- delve AlmaLinux 8 1.25.2-1.module_el8.10.0+4074+24330916
- golang AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- go-toolset AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-bin AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-src AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-misc AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-race AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
- golang-tests AlmaLinux 8 1.25.10-1.module_el8.10.0+4187+c45165c4
almalinux advisories ALSA-2026:22112
- go Alpine 3.23 1.25.9-r0
- go Alpine 3.24 1.26.2-r0
- rclone Alpine 3.24 1.73.5-r0
alpine advisories ALPINE-CVE-2026-32288
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- containerized-data-importer Azure Linux 3.0 1.62.0-3
- gh Azure Linux 3.0 2.62.0-15
- moby-engine Azure Linux 3.0 25.0.3-17
- skopeo Azure Linux 3.0 1.14.4-10
azure linux advisories AZL-82169AZL-82292AZL-82458AZL-82608
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- go.dev/cl/763766 patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-32288 updated cvss 4.3
archive/tar: golang: Go's archive/tar package: Denial of Service via maliciously-crafted archive
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 redhat-user-workloads/assisted-installer-tenant/assisted-installer-application-ds-main/assisted-installer-ds-main Red Hat Builds for Red Hat OpenShift redhat-user-workloads/rh-openshift-builds-tenant/openshift-builds-waiter-1-6, redhat-user-workloads/rh-openshift-builds-tenant/openshift-builds-waiter-1-7 Red Hat cert-manager Operator for Red Hat OpenShift redhat-user-workloads/cert-manager-oape-tenant/jetstack-cert-manager-1-17/jetstack-cert-manager-1-17, redhat-user-workloads/cert-manager-oape-tenant/jetstack-cert-manager-1-18/jetstack-cert-manager-1-18 Red Hat Confidential Compute Attestation redhat-user-workloads/ose-osc-tenant/osc-caa Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift redhat-user-workloads/cma-podauto-tenant/custom-metrics-autoscaler-operator/keda-adapteraffected: workaround, no fix available “Fix deferred”
+24 more productsfewer
Red Hat Deployment Validation Operator redhat-user-workloads/dvo-obsint-tenant/deployment-validation-operator/deployment-validation-operator Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift redhat-user-workloads/ocp-art-tenant/art-images, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-0, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-2, redhat-user-workloads/obs-logging-tenant/logging-loki-v6-4 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, redhat-user-workloads/ocp-art-tenant/art-images Red Hat Migration Toolkit for Containers redhat-user-workloads/ocp-art-tenant/art-images Red Hat Multicluster Engine for Kubernetes redhat-user-workloads/crt-redhat-acm-tenant/backplane-operator-mce-28, redhat-user-workloads/crt-redhat-acm-tenant/backplane-operator-mce-29, redhat-user-workloads/crt-redhat-acm-tenant/backplane-operator-mce-210, redhat-user-workloads/crt-redhat-acm-tenant/backplane-operator-mce-211, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-26/backplane-operator-mce-26, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-27/backplane-operator-mce-27 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel8, multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Network Observability Operator redhat-user-workloads/ocp-network-observab-tenant/flowlogs-pipeline-zstream Red Hat OpenShift API for Data Protection redhat-user-workloads/ocp-art-tenant/art-images Red Hat OpenShift Developer Tools and Services helm Red Hat OpenShift Lightspeed redhat-user-workloads/crt-nshift-lightspeed-tenant/openshift-mcp-server Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Serverless openshift-serverless-clients, redhat-user-workloads/ocp-serverless-tenant/serverless-operator-137/kn-plugin-event-sender Red Hat OpenShift Service Mesh 2 ossm-2/openshift-golang-builder-container, redhat-user-workloads/service-mesh-tenant/ossm-2-6-cni Red Hat OpenShift Service Mesh 3 ossm-2/openshift-golang-builder-container, redhat-user-workloads/service-mesh-tenant/ossm-3-0-cni, redhat-user-workloads/service-mesh-tenant/ossm-3-1-cni, redhat-user-workloads/service-mesh-tenant/ossm-3-2-cni, redhat-user-workloads/service-mesh-tenant/ossm-3-3-cni Red Hat OpenShift Source-to-Image (S2I) source-to-image/source-to-image-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/volsync-tenant/volsync-0-13, redhat-user-workloads/volsync-tenant/volsync-0-14, redhat-user-workloads/volsync-tenant/volsync-0-15 Red Hat Advanced Cluster Security 4 rhacs-eng/release-main Red Hat Ceph Storage 5 rhceph-ci/grafana Red Hat Ceph Storage 6 rhceph-ci/grafana Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Connectivity Link 1 redhat-user-workloads/api-management-tenant/rhcl-1-3-authorino Red Hat Edge Manager 1 flightctl, redhat-user-workloads/edge-manager-tenant/flightctl/flightctl-api Red Hat Enterprise Linux 8 conmon, podman, skopeo, buildah, grafana, grafana-loki, +27 more -
Red Hat Enterprise Linux 9 conmon, podman, skopeo, buildah, grafana, go-toolset, +15 moreaffected: workaround, no fix available, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 10 podman, skopeo, buildah, grafana, image-builder, osbuild-composer Red Hat Enterprise Linux AI (RHEL AI) 3 golang Red Hat OpenShift AI (RHOAI) rhoai/odh-trainer-rhel9, rhoai/odh-rhel8-operator, rhoai/odh-rhel9-operator Red Hat OpenShift Container Platform 4 cri-o, conmon, podman, skopeo, openshift, microshift, +40 more Red Hat Openshift Data Foundation 4 ocs4/cephcsi-rhel8, odf4/cephcsi-rhel8, odf4/cephcsi-rhel9, rhceph-dev/odf4-cephcsi-rhel9 Red Hat OpenShift Dev Spaces redhat-user-workloads/devspaces-tenant/devspaces/udi-rhel9affected: workaround, no fix available “Fix deferred”
+3 more productsfewer
Red Hat OpenShift distributed tracing 3 redhat-user-workloads/rhosdt-tenant/tempo/tempo Red Hat OpenShift for Windows Containers redhat-user-workloads/windows-machine-conf-tenant/windows-machine-config-operator/windows-machine-config-operator-releas Red Hat OpenShift GitOps redhat-user-workloads/rh-openshift-gitops-tenant/dex-rhel8, redhat-user-workloads/rh-openshift-gitops-tenant/dex-rhel9
11 more affected, 6 more fixed in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | golang | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
| go | stdlib | <1.25.9 >=1.26.0-0, <1.26.2 |
1.25.9 1.26.2 |
Affected products
- Go standard library archive/tar
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
go.dev
/cl/763766
patch
-
pkg.go.dev
/vuln/GO-2026-4869
vendor-advisory, advisory
-
go.dev
/issue/78301
issue-tracking, report
-
groups.google.com
/g/golang-announce/c/0uYbvbPZRWU
mailing-list, release-notes, discussion, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32288
web
Sources
- CVE List CVE-2026-32288
- NVD CVE-2026-32288
- OSV BIT-golang-2026-32288
- OSV GO-2026-4869
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.