{"id":"CVE-2022-2879","aliases":["GO-2022-1037","BIT-golang-2022-2879"],"title":"Unbounded memory consumption when reading headers in archive/tar","summary":"Unbounded memory consumption when reading headers in archive/tar","severity":"none","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.19.0-0, < 1.19.2"],"patched":["stdlib 1.19.2"],"published":"2022-10-06","updated":"2026-07-15","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2022-1037","references":[{"url":"https://go.dev/issue/54853"},{"url":"https://go.dev/cl/439355"},{"url":"https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"}],"tags":["osv","go"],"epss":0.01667,"epssPercentile":0.75353,"ingestedAt":"2026-07-16T18:59:42.673Z","slug":"CVE-2022-2879","body":"## Overview\n\nReader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.\n\n## Affected packages\n\n- `stdlib >= 1.19.0-0, < 1.19.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.19.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}