tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

ROOT-APP-NPM-CVE-2026-53655 CVE-2026-53655 in tar - Patched by Root

Root has patched CVE-2026-53655 in the tar package for Root:npm. Multiple fixed versions available...

GHSA-JQQW-37X4-9RWJ vulnerabilities

Vulnerabilities for packages: gnutar...

CVE-2026-5704 vulnerabilities

Vulnerabilities for packages: gnutar...

CVE-2026-19672

The tarfile modules tar and data extraction filters created director...

CVE-2026-76358 Path Traversal through App Installation Tar Extraction in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file...

CVE-2026-76358

In Splunk SOAR versions below 8.6.0, the app-installation archive extraction routine fails to validate extracted file paths, allowing users with app-install privileges to write files outside the intended temporary directory, enabling arbitrary file overwrite (HIGH integrity/availability impact, C...

CVE-2026-53542

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542 Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-53542

CVE-2026-53542 is a tar option injection vulnerability in Termix , a web-based server management platform, prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-selected file basenames to tar without an end-of-options marker (--) and without ensuring...

EUVD-2026-62858

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

GHSA-93J5-89VC-PPH4 vulnerabilities

Vulnerabilities for packages: logstash-fips, traccar-fips, zipkin, conductor-fips, thingsboard, nuxeo, traccar, logstash, cassandra-reaper, conductor, druid...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-2739 DESCRIPTION: This affects versions of the package bn.js before 5.2.3. Calling maskn0 on any BN instance...

CLSA-2026-1787146736 TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 2.2.2-tuxcare.2...

CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, U...

Linux Distros Unpatched Vulnerability : CVE-2026-17106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to...

UBUNTU-CVE-2026-17106

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, U...

moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. Details The extracto...