Skip to content
OpenAdvisories
Critical RHSA-2026:30852 1 CVE

Red Hat Security Advisory: perl-Archive-Tar security update

Published Jun 29, 2026 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-Archive-Tar 0:2.30-2.el8_10

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-42496

    Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

    Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The …

    BINGOS Archive::Tar perl perl Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481314
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30852.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-42496
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42496
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42496
  • article
    https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch
  • article
    https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42497