JLSEC-2026-153

An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service Out-of-Memory crash...

The vulnerability of the apply_substitution function in the libarchive library allows a perpetrator to trigger a service failure.

The vulnerability of the applysubstitution function in the libarchive library is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow an attacker to cause service failures...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the applysubstitution function in the bsdtar when used with -s pathname-rewrite rules. An attacker can cause excessive memory allocation leading to application crash by supplying malicious input such as an empty patter...