---
id: CVE-2022-2879
aliases:
  - GO-2022-1037
  - BIT-golang-2022-2879
title: Unbounded memory consumption when reading headers in archive/tar
summary: Unbounded memory consumption when reading headers in archive/tar
severity: none
vendor: stdlib
product: stdlib
ecosystem: go
affected:
  - 'stdlib >= 1.19.0-0, < 1.19.2'
patched:
  - stdlib 1.19.2
published: '2022-10-06'
updated: '2026-07-15'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2022-1037'
references:
  - url: 'https://go.dev/issue/54853'
  - url: 'https://go.dev/cl/439355'
  - url: 'https://groups.google.com/g/golang-announce/c/xtuG5faxtaU'
tags:
  - osv
  - go
epss: 0.01667
epssPercentile: 0.75731
ingestedAt: '2026-07-16T18:59:42.673Z'
---

## Overview

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

## Affected packages

- `stdlib >= 1.19.0-0, < 1.19.2`

## Remediation

Upgrade to a patched release:

- `stdlib 1.19.2`