Medium · 5.5 CVE-2026-32288 BIT-golang-2026-32288EUVD-2026-20016GHSA-x4jj-h2v8-hqqvGO-2026-4869

Unbounded allocation for old GNU sparse in archive/tar

Published Apr 8, 2026 · Updated Apr 13, 2026 · Assigned by Go

Vendor: Go standard library Product: archive/tar Package: aactl Package: act Package: apko Package: argo-cd-3.3 Package: argo-cd-3.3-compat Package: argo-workflow-executor-3.7 Package: atlantis Package: aws-flb-cloudwatch Package: aws-flb-firehose Package: aws-flb-kinesis Package: bank-vaults Package: bento Package: bom Package: buf Package: buildah Package: caddy Package: cerbos Package: cerbosctl Package: cert-manager-1.20 Package: cert-manager-acmesolver-1.20 Package: cert-manager-cainjector-1.20 Package: cert-manager-cmctl Package: cert-manager-controller-1.20 Package: cert-manager-startupapicheck-1.20 Package: cert-manager-webhook-1.20 Package: chartmuseum Package: chezmoi Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cilium-cli Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-aws-1.31-ecr-credential-provider Package: consul-k8s-1.9-cli Package: containerized-data-importer Package: coredns-1.13 Package: coredns-1.14 Package: cosign Package: crane Package: crane-cov Package: cri-o Package: crossplane-2.2 Package: crossplane-2.2-crank Package: dapr-daprd-1.17 Package: dask-gateway-server Package: datadog-agent-7.72 Package: datadog-agent-7.73 Package: datadog-cluster-agent-7.72 Package: datadog-cluster-agent-7.73 Package: dex Package: dgraph Package: dive Package: docker-cli Package: docker-cli-buildx Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: eksctl Package: envconsul Package: envoy-gateway Package: envoy-gateway-egctl Package: external-secrets-operator-1.1 Package: extism Package: falco-no-driver Package: falcoctl Package: filebrowser Package: flux-2.8 Package: flux-helm-controller Package: flux-source-controller Package: fscrypt Package: fuse-overlayfs-snapshotter Package: gh Package: gh Package: gitaly-18.10 Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-18.9 Package: gitaly-backup-18.6 Package: gitaly-backup-18.7 Package: gitaly-init-cgroups-18.6 Package: gitaly-init-cgroups-18.7 Package: gitea Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-pages-18.6 Package: gitlab-pages-18.7 Package: gitleaks Package: gitness Package: gitsign Package: go Package: go-1.24 Package: go-1.24-asm Package: go-1.24-covdata Package: go-1.24-cover Package: go-1.24-nm Package: go-1.24-objdump Package: go-1.24-test2json Package: go-1.26 Package: golang Package: golang-1.10 Package: golang-1.13 Package: golang-1.14 Package: golang-1.16 Package: golang-1.17 Package: golang-1.18 Package: golang-1.19 Package: golang-1.20 Package: golang-1.21 Package: golang-1.22 Package: golang-1.23 Package: golang-1.24 Package: golang-1.24 Package: golang-1.25 Package: golang-1.26 Package: golang-1.6 Package: golang-1.8 Package: golang-1.9 Package: goreleaser Package: gpu-feature-discovery Package: grafana-mimir-3.0 Package: grafana-mimir-3.0-mimirtool-3.0 Package: grafana-operator Package: harbor-2.14 Package: harbor-2.14-exporter Package: harbor-2.14-jobservice Package: helm-3 Package: helm-4 Package: helm-mapkubeapis Package: helm-push Package: helm-set-status Package: hubble Package: incert Package: ingress-nginx-controller-1.12 Package: ipfs-cluster Package: k3d Package: k3d-proxy Package: k8ssandra-client Package: kaf Package: kargo Package: kbld Package: kind Package: kine Package: ko Package: kots Package: kpt Package: krane Package: kube-apiserver-1.34 Package: kube-apiserver-1.35 Package: kube-arangodb-1.4 Package: kube-controller-manager-1.34 Package: kube-controller-manager-1.35 Package: kube-fluentd-operator Package: kube-proxy-1.34 Package: kube-proxy-1.35 Package: kube-scheduler-1.34 Package: kube-scheduler-1.35 Package: kubeadm-1.34 Package: kubeadm-1.35 Package: kubectl-1.31 Package: kubectl-1.32 Package: kubectl-1.34 Package: kubectl-1.35 Package: kubelet-1.34 Package: kubelet-1.35 Package: kubernetes-1.34 Package: kubernetes-1.35 Package: kubernetes-csi-driver-nfs Package: kubernetes-dashboard Package: kubescape Package: kuma-coredns-1.13 Package: kwokctl Package: kyverno-1.17 Package: kyverno-background-controller-1.17 Package: kyverno-cleanup-controller-1.17 Package: kyverno-cli-1.17 Package: kyverno-init-container-1.17 Package: kyverno-readiness-checker-1.17 Package: kyverno-reports-controller-1.17 Package: libnvidia-container Package: licenseclassifier Package: linkerd2-cli Package: linkerd2-controller Package: mailpit Package: malcontent Package: mattermost-11.1 Package: mattermost-11.5 Package: mesosphere-vsphere-csi-driver Package: mesosphere-vsphere-csi-syncer Package: minio-operator Package: moby-engine Package: mps-control-daemon Package: nats Package: nats-server Package: nerdctl Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-fluent-bit-output Package: newrelic-infrastructure-agent Package: no-docs-check Package: nsc Package: nuclei Package: nvidia-device-plugin Package: opa-envoy Package: openbao Package: opentelemetry-collector Package: opentofu-1.9 Package: oras Package: osv-scanner Package: paranoia Package: percona-server-mongodb-operator Package: podman Package: policy-controller Package: policy-controller-tester Package: prometheus-3.10 Package: prometheus-3.8 Package: prometheus-3.9 Package: prometheus-admission-webhook Package: prometheus-config-reloader Package: prometheus-operator Package: pulumi Package: pulumi-language-go Package: pulumi-language-java Package: pulumi-language-nodejs Package: pulumi-language-python Package: pulumi-language-yaml Package: rabbitmq-messaging-topology-operator Package: rancher-2.13 Package: rancher-agent-2.13 Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-helm-3 Package: rancher-machine Package: rclone Package: rclone Package: redka Package: regclient-regbot Package: regclient-regctl Package: regclient-regsync Package: rook Package: rpk-26.1.2 Package: runc Package: scorecard Package: seaweedfs Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-server Package: skopeo Package: slsa-verifier Package: snyk-cli Package: sonobuoy Package: spegel Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: sriov-network-device-plugin Package: stdlib Package: step-ca Package: syft Package: symlink-check Package: task Package: terraform Package: timestamp-authority-server Package: timoni Package: tkn Package: tofu-controller Package: tofu-controller-runner Package: trivy Package: trivy-operator Package: tw Package: twt Package: vault-benchmark Package: vault-env Package: vendir Package: wal-g-pg Package: weaviate Package: witness Package: xeol Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Affected products

Vendor	Product	Affected	Fixed
Go standard library	archive/tar	< 1.25.9, 1.26.0-0 – < 1.26.2	1.25.9

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	golang-1.26	1.26.2-1	—
Debian 13	golang-1.24	No fix yet	—
Debian 12	golang-1.19	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.04 LTS	golang-1.23 +1	No fix yet	—
Ubuntu 25.10	golang-1.23 +2	No fix yet	—
Ubuntu 24.04 LTS	golang-1.21 +4	No fix yet	—
Ubuntu 22.04 LTS	golang-1.17 +7	No fix yet	—
Ubuntu 20.04 LTS	golang-1.13 +5	No fix yet	—

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	golang-1.8 +2	No fix yet	—
Ubuntu 16.04 LTS	golang-1.6 +1	No fix yet	—
Ubuntu 14.04 LTS	golang-1.10	No fix yet	—
Ubuntu Pro 22.04 LTS	golang-1.13	No fix yet	—
Ubuntu Pro 20.04 LTS	golang-1.16	No fix yet	—
Ubuntu Pro 18.04 LTS	golang-1.13 +2	No fix yet	—
Ubuntu Pro 16.04 LTS	golang-1.13 +1	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	golang +7	1.25.9-3.el10_1	RHSA-2026:10217
RHEL 9	golang +7	1.25.9-1.el9_7	RHSA-2026:10219
RHEL 8	delve	1.25.2-1.module+el8.10.0+23746+9db33b5e	RHSA-2026:22112
RHEL 8	golang +7	1.25.10-1.module+el8.10.0+24308+5c4a16b7	RHSA-2026:22112

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Hardened Images 1	golang1.25 +6	1.25.9-1.hum1	RHSA-2026:7385
Red Hat Hardened Images 1	golang1.26 +6	1.26.2-1.hum1	RHSA-2026:7291

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 8	delve	1.25.2-1.module_el8.10.0+4074+24330916	ALSA-2026:22112
AlmaLinux 8	golang +7	1.25.10-1.module_el8.10.0+4187+c45165c4	ALSA-2026:22112

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES 15 SP7	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES 15 SP6	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES 15 SP6	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES 15 SP5	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES 15 SP5	go1.25-openssl	1.25.9-150000.1.21.1	SUSE-SU-2026:1581-1
SLES 15 SP5	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES 15 SP5	go1.26-openssl	1.26.2-150000.1.6.1	SUSE-SU-2026:1580-1
SLES 15 SP4	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES 15 SP4	go1.25-openssl	1.25.9-150000.1.21.1	SUSE-SU-2026:1581-1
SLES 15 SP4	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES 15 SP4	go1.26-openssl	1.26.2-150000.1.6.1	SUSE-SU-2026:1580-1

Show 7 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 16.0	go1.25-openssl	1.25.12-160000.1.1	SUSE-SU-2026:22638-1
SLES for SAP 16.0	go1.26-openssl	1.26.4-160000.1.1	SUSE-SU-2026:22572-1
SLES for SAP 15 SP6	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES for SAP 15 SP6	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES for SAP 15 SP5	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES for SAP 15 SP5	go1.25-openssl	1.25.9-150000.1.21.1	SUSE-SU-2026:1581-1
SLES for SAP 15 SP5	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES for SAP 15 SP5	go1.26-openssl	1.26.2-150000.1.6.1	SUSE-SU-2026:1580-1
SLES for SAP 15 SP4	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLES for SAP 15 SP4	go1.25-openssl	1.25.9-150000.1.21.1	SUSE-SU-2026:1581-1
SLES for SAP 15 SP4	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLES for SAP 15 SP4	go1.26-openssl	1.26.2-150000.1.6.1	SUSE-SU-2026:1580-1
SLES 16.0	go1.25-openssl	1.25.12-160000.1.1	SUSE-SU-2026:22638-1
SLES 16.0	go1.26-openssl	1.26.4-160000.1.1	SUSE-SU-2026:22572-1
SLE HPC 15 SP5	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLE HPC 15 SP5	go1.25-openssl	1.25.9-150000.1.21.1	SUSE-SU-2026:1581-1
SLE HPC 15 SP5	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLE HPC 15 SP5	go1.26-openssl	1.26.2-150000.1.6.1	SUSE-SU-2026:1580-1
SLE HPC 15 SP4	go1.25	1.25.9-150000.1.35.1	SUSE-SU-2026:1321-1
SLE HPC 15 SP4	go1.25-openssl	1.25.9-150000.1.21.1	SUSE-SU-2026:1581-1
SLE HPC 15 SP4	go1.26	1.26.2-150000.1.9.1	SUSE-SU-2026:1320-1
SLE HPC 15 SP4	go1.26-openssl	1.26.2-150000.1.6.1	SUSE-SU-2026:1580-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	go1.25	1.25.9-1.1	openSUSE-SU-2026:10514-1
openSUSE Tumbleweed	go1.26	1.26.2-1.1	openSUSE-SU-2026:10525-1
openSUSE Leap 16.0	go1.25	1.25.9-160000.1.1	openSUSE-SU-2026:20570-1
openSUSE Leap 16.0	go1.25-openssl	1.25.12-160000.1.1	openSUSE-SU-2026:21319-1
openSUSE Leap 16.0	go1.26	1.26.2-160000.1.1	openSUSE-SU-2026:20571-1
openSUSE Leap 16.0	go1.26-openssl	1.26.4-160000.1.1	openSUSE-SU-2026:21254-1
openSUSE Leap 16.0	govulncheck-vulndb	0.0.20260723T184607-160000.1.1	openSUSE-SU-2026:21483-1

Alpine

Security tracker ↗

Release	Package	Fixed in	Advisory
Alpine v3.24	go	1.26.2-r0	—
Alpine v3.24	rclone	1.73.5-r0	—
Alpine v3.23	go	1.25.9-r0	—

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	amazon-cloudwatch-agent	1.300066.2-2.amzn2023	ALAS2023-2026-1747
Amazon Linux 2023	amazon-ecr-credential-helper	0.12.0-2.amzn2023	ALAS2023-2026-1645
Amazon Linux 2023	containerd +1	2.2.3-1.amzn2023.0.1	ALAS2023-2026-1606
Amazon Linux 2023	credentials-fetcher	2.0.1-1.amzn2023.0.3	ALAS2023-2026-1598
Amazon Linux 2023	docker	25.0.14-1.amzn2023.0.4	ALAS2023-2026-1615
Amazon Linux 2023	ecs-init	1.103.0-1.amzn2023	ALAS2023-2026-1637
Amazon Linux 2023	golang +6	1.25.9-1.amzn2023.0.1	ALAS2023-2026-1593
Amazon Linux 2023	golist	0.10.4-12.amzn2023.0.8	ALAS2023-2026-1599
Amazon Linux 2023	nerdctl	2.2.2-1.amzn2023.0.1	ALAS2023-2026-1605
Amazon Linux 2023	oci-add-hooks	0-0.1.20200504git268e3bb.amzn2023.0.10	ALAS2023-2026-1660
Amazon Linux 2023	runc	1.3.4-4.amzn2023.0.2	ALAS2023-2026-1661
Amazon Linux 2023	runfinch-finch	1.17.0-1.amzn2023.0.1	ALAS2023-2026-1671
Amazon Linux 2023	soci-snapshotter	0.13.0-1.amzn2023.0.2	ALAS2023-2026-1700
Amazon Linux 2023	yq	4.47.1-12.amzn2023	ALAS2023-2026-1582
Amazon Linux 2	amazon-cloudwatch-agent	1.300066.2-2.amzn2	ALAS2-2026-3323
Amazon Linux 2	golang +6	1.25.9-1.amzn2.0.1	ALAS2-2026-3259
Amazon Linux 2	golist	0.10.1-10.amzn2.0.12	ALAS2-2026-3260
Amazon Linux 2	nerdctl	2.2.2-1.amzn2.0.1	ALAS2-2026-3265

Azure Linux

Release	Package	Fixed in	Advisory
Azure Linux 3	containerized-data-importer	1.62.0-3	—
Azure Linux 3	cri-o +1	No fix yet	—
Azure Linux 3	gh	2.62.0-15	—
Azure Linux 3	moby-engine	25.0.3-17	—
Azure Linux 3	skopeo	1.14.4-10	—

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	aactl	0.4.12-r53	—
Wolfi rolling	act	0.2.87-r2	—
Wolfi rolling	apko	1.2.15-r0	—
Wolfi rolling	argo-cd-3.3	3.3.6-r4	—
Wolfi rolling	argo-cd-3.3-compat	3.3.7-r0	—
Wolfi rolling	argo-workflow-executor-3.7	3.7.13-r1	—
Wolfi rolling	atlantis	0.42.0-r0	—
Wolfi rolling	aws-flb-cloudwatch	1.9.5-r2	—
Wolfi rolling	aws-flb-firehose	1.7.2-r26	—
Wolfi rolling	aws-flb-kinesis	1.10.4-r2	—
Wolfi rolling	bank-vaults	1.32.1-r19	—
Wolfi rolling	bento	1.17.0-r1	—
Wolfi rolling	bom	0.7.1-r21	—
Wolfi rolling	buf	1.68.3-r0	—
Wolfi rolling	buildah	1.44.0-r0	—
Wolfi rolling	caddy	2.11.2-r11	—
Wolfi rolling	cerbos +1	0.53.0-r6	—
Wolfi rolling	cert-manager-1.20 +5	1.20.2-r0	—
Wolfi rolling	cert-manager-cmctl	2.4.1-r5	—
Wolfi rolling	chartmuseum	0.16.5-r10	—
Wolfi rolling	chezmoi	2.70.4-r2	—
Wolfi rolling	cilium-1.19 +1	1.19.4-r4	—
Wolfi rolling	cilium-1.19-hubble-relay +2	1.19.3-r0	—
Wolfi rolling	cilium-cli	0.19.4-r0	—
Wolfi rolling	cloud-provider-aws-1.31-ecr-credential-provider +1	1.31.9-r12	—
Wolfi rolling	consul-k8s-1.9-cli	1.9.8-r2	—
Wolfi rolling	coredns-1.13 +1	1.13.2-r4	—
Wolfi rolling	coredns-1.14	1.14.2-r6	—
Wolfi rolling	cosign	3.0.5-r9	—
Wolfi rolling	crane +2	0.21.6-r2	—
Wolfi rolling	crossplane-2.2 +1	2.2.0-r8	—
Wolfi rolling	dapr-daprd-1.17	1.17.5-r0	—
Wolfi rolling	dask-gateway-server	2026.3.0-r1	—
Wolfi rolling	dex	2.45.1-r6	—
Wolfi rolling	dgraph	25.3.2-r0	—
Wolfi rolling	dive	0.13.1-r17	—
Wolfi rolling	docker-cli	29.4.1-r0	—
Wolfi rolling	docker-cli-buildx	0.34.1-r3	—
Wolfi rolling	dogstatsd-7.72 +2	7.72.4-r17	—
Wolfi rolling	dogstatsd-7.73 +2	7.73.3-r9	—
Wolfi rolling	eksctl	0.225.0-r4	—
Wolfi rolling	envconsul	0.13.4-r14	—
Wolfi rolling	envoy-gateway	1.7.1-r4	—
Wolfi rolling	envoy-gateway-egctl	1.7.2-r0	—
Wolfi rolling	external-secrets-operator-1.1	1.1.1-r6	—
Wolfi rolling	extism	1.6.3-r12	—
Wolfi rolling	falco-no-driver	0.43.0-r7	—
Wolfi rolling	falcoctl	0.12.2-r10	—
Wolfi rolling	filebrowser	2.63.5-r2	—
Wolfi rolling	flux-2.8	2.8.8-r2	—
Wolfi rolling	flux-helm-controller	1.5.5-r2	—
Wolfi rolling	flux-source-controller	1.8.2-r4	—
Wolfi rolling	fscrypt	0.3.6-r9	—
Wolfi rolling	fuse-overlayfs-snapshotter	2.1.7-r11	—
Wolfi rolling	gh	2.90.0-r0	—
Wolfi rolling	gitaly-18.10	18.10.3-r1	—
Wolfi rolling	gitaly-18.6 +2	18.6.6-r9	—
Wolfi rolling	gitaly-18.7 +5	18.7.6-r1	—
Wolfi rolling	gitaly-18.8	18.8.9-r2	—
Wolfi rolling	gitaly-18.9	18.9.8-r1	—
Wolfi rolling	gitea	1.26.2-r3	—
Wolfi rolling	gitlab-kas-18.6 +1	18.6.6-r7	—
Wolfi rolling	gitlab-pages-18.6	18.6.6-r4	—
Wolfi rolling	gitleaks	8.30.1-r13	—
Wolfi rolling	gitness	3.3.0-r20	—
Wolfi rolling	gitsign	0.16.0-r6	—
Wolfi rolling	go-1.24 +7	No fix yet	—
Wolfi rolling	go-1.26	1.26.2-r0	—
Wolfi rolling	goreleaser	2.15.3-r1	—
Wolfi rolling	grafana-mimir-3.0 +1	3.0.5-r5	—
Wolfi rolling	grafana-operator	5.22.2-r4	—
Wolfi rolling	harbor-2.14 +2	2.14.3-r5	—
Wolfi rolling	helm-3	3.22.0-r0	—
Wolfi rolling	helm-4	4.1.4-r1	—
Wolfi rolling	helm-mapkubeapis	0.6.1-r19	—
Wolfi rolling	helm-push	0.11.1-r8	—
Wolfi rolling	helm-set-status	0.3.0-r14	—
Wolfi rolling	hubble	1.18.6-r6	—
Wolfi rolling	incert	0.5.0-r17	—
Wolfi rolling	ingress-nginx-controller-1.12	1.12.8-r8	—
Wolfi rolling	ipfs-cluster	1.1.6-r2	—
Wolfi rolling	k3d +1	5.8.3-r31	—
Wolfi rolling	k8ssandra-client	0.8.11-r5	—
Wolfi rolling	kaf	0.2.14-r5	—
Wolfi rolling	kargo	1.10.5-r0	—
Wolfi rolling	kbld	0.48.1-r0	—
Wolfi rolling	kind	0.31.0-r11	—
Wolfi rolling	kine	0.14.16-r1	—
Wolfi rolling	ko	0.18.1-r17	—
Wolfi rolling	kots	1.130.0-r4	—
Wolfi rolling	kpt	1.0.0_beta55-r24	—
Wolfi rolling	kube-arangodb-1.4	1.4.1-r14	—
Wolfi rolling	kube-fluentd-operator	1.18.2-r65	—
Wolfi rolling	kubeadm-1.34 +7	1.34.7-r0	—
Wolfi rolling	kubeadm-1.35 +7	1.35.4-r0	—
Wolfi rolling	kubectl-1.32	1.32.13-r1	—
Wolfi rolling	kubernetes-csi-driver-nfs	4.13.2-r6	—
Wolfi rolling	kubernetes-dashboard	7.14.0-r5	—
Wolfi rolling	kubescape	4.0.3-r3	—
Wolfi rolling	kwokctl	0.7.0-r24	—
Wolfi rolling	kyverno-1.17 +6	1.17.1-r15	—
Wolfi rolling	libnvidia-container	1.19.0-r0	—
Wolfi rolling	licenseclassifier	2.0.0-r13	—
Wolfi rolling	linkerd2-cli +1	26.4.3-r0	—
Wolfi rolling	mailpit	1.30.1-r2	—
Wolfi rolling	malcontent	1.22.0-r1	—
Wolfi rolling	mattermost-11.1	11.1.3-r3	—
Wolfi rolling	mattermost-11.5	11.5.1-r6	—
Wolfi rolling	mesosphere-vsphere-csi-driver +1	3.5.0-r15	—
Wolfi rolling	minio-operator	7.1.1-r22	—
Wolfi rolling	mps-control-daemon +1	0.19.0-r3	—
Wolfi rolling	nats	0.3.2-r3	—
Wolfi rolling	nats-server	2.14.1-r1	—
Wolfi rolling	nerdctl	2.3.1-r3	—
Wolfi rolling	neuvector-scanner +1	4.179-r0	—
Wolfi rolling	newrelic-fluent-bit-output	3.4.1-r3	—
Wolfi rolling	newrelic-infrastructure-agent	1.76.1-r0	—
Wolfi rolling	nsc	2.14.0-r1	—
Wolfi rolling	nuclei	3.8.0-r9	—
Wolfi rolling	nvidia-device-plugin	0.19.2-r0	—
Wolfi rolling	opa-envoy	1.15.2-r2	—
Wolfi rolling	openbao	2.5.2-r3	—
Wolfi rolling	opentofu-1.9	1.9.4-r13	—
Wolfi rolling	oras	1.3.2-r3	—
Wolfi rolling	osv-scanner	2.3.5-r1	—
Wolfi rolling	paranoia	0.5.0-r7	—
Wolfi rolling	percona-server-mongodb-operator	1.22.0-r13	—
Wolfi rolling	podman	5.8.2-r0	—
Wolfi rolling	policy-controller +1	0.15.1-r4	—
Wolfi rolling	prometheus-3.10	3.10.0-r5	—
Wolfi rolling	prometheus-3.8	3.8.1-r4	—
Wolfi rolling	prometheus-3.9	3.9.1-r6	—
Wolfi rolling	prometheus-operator +2	0.90.1-r3	—
Wolfi rolling	pulumi +3	3.229.0-r4	—
Wolfi rolling	pulumi-language-java	1.22.0-r4	—
Wolfi rolling	pulumi-language-yaml	1.35.0-r2	—
Wolfi rolling	rabbitmq-messaging-topology-operator	1.19.2-r3	—
Wolfi rolling	rancher-2.13	2.13.4-r4	—
Wolfi rolling	rancher-agent-2.13	2.13.4-r3	—
Wolfi rolling	rancher-fleet-cli +2	0.15.2-r1	—
Wolfi rolling	rancher-helm-3	3.20.0-r13	—
Wolfi rolling	rancher-machine	0.15.0.142-r3	—
Wolfi rolling	rclone	1.74.2-r1	—
Wolfi rolling	redka	1.0.1-r1	—
Wolfi rolling	regclient-regbot	0.11.2-r4	—
Wolfi rolling	regclient-regctl +1	0.11.3-r0	—
Wolfi rolling	rook	1.19.4-r0	—
Wolfi rolling	rpk-26.1.2	26.1.2-r1	—
Wolfi rolling	runc	1.4.2-r4	—
Wolfi rolling	scorecard	5.4.0-r16	—
Wolfi rolling	seaweedfs	4.20-r0	—
Wolfi rolling	sigstore-scaffolding-tuf-server +1	0.7.31-r11	—
Wolfi rolling	slsa-verifier	2.7.1-r17	—
Wolfi rolling	snyk-cli	1.1304.0-r0	—
Wolfi rolling	sonobuoy	0.57.3-r22	—
Wolfi rolling	spegel	0.7.1-r2	—
Wolfi rolling	spire-agent +2	1.14.5-r0	—
Wolfi rolling	splunk-otel-collector +1	0.149.0-r1	—
Wolfi rolling	sriov-network-device-plugin	3.11.0-r12	—
Wolfi rolling	step-ca	0.30.2-r9	—
Wolfi rolling	syft	1.42.4-r2	—
Wolfi rolling	task	3.50.0-r0	—
Wolfi rolling	terraform	1.5.7-r46	—
Wolfi rolling	timestamp-authority-server	2.1.0-r1	—
Wolfi rolling	timoni	0.26.0-r12	—
Wolfi rolling	tkn	0.44.1-r2	—
Wolfi rolling	tofu-controller +1	0.16.2-r0	—
Wolfi rolling	trivy	0.70.0-r3	—
Wolfi rolling	trivy-operator	0.30.1-r5	—
Wolfi rolling	tw +3	0.0.49-r0	—
Wolfi rolling	vault-benchmark	0.4.0-r18	—
Wolfi rolling	vault-env	1.22.1-r9	—
Wolfi rolling	vendir	0.45.3-r4	—
Wolfi rolling	wal-g-pg	3.0.8-r16	—
Wolfi rolling	weaviate	1.37.7-r0	—
Wolfi rolling	witness	0.11.0-r6	—
Wolfi rolling	xeol	0.10.8-r43	—
Wolfi rolling	zot	2.1.15-r12	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	stdlib	< 1.25.9 · >= 1.26.0-0, < 1.26.2	1.25.9, 1.26.2	GO-2026-4869

Advisories 40

WID-SEC-2026-1006 Golang Go: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
ALSA-2026:22112 Important: go-toolset:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:7385 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:7291 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:22112 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:10217 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:10219 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
WID-SEC-2026-1407 IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 3, 2026
openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
SUSE-SU-2026:22638-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 17, 2026
openSUSE-SU-2026:21319-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Jul 15, 2026
SUSE-SU-2026:22572-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Jul 15, 2026
openSUSE-SU-2026:21254-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Jul 9, 2026
ALAS2-2026-3323 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 6, 2026
ALAS2023-2026-1747 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 6, 2026
ALAS2023-2026-1700 Moderate: soci-snapshotter security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 15, 2026
ALAS2023-2026-1660 Moderate: oci-add-hooks security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
ALAS2023-2026-1661 Moderate: runc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
ALAS2023-2026-1671 Moderate: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
ALAS2023-2026-1637 Moderate: ecs-init security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
ALAS2023-2026-1645 Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
ALAS2023-2026-1606 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 9, 2026
ALAS2023-2026-1582 Moderate: yq security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 9, 2026
ALAS2023-2026-1593 Important: golang security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
ALAS2023-2026-1598 Moderate: credentials-fetcher security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
ALAS2023-2026-1599 Moderate: golist security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
ALAS2023-2026-1605 Important: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
ALAS2023-2026-1615 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 30, 2026
ALAS2-2026-3259 Important: golang security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
ALAS2-2026-3260 Moderate: golist security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
ALAS2-2026-3265 Important: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
SUSE-SU-2026:1580-1 Security update for go1.26-openssl SUSE / openSUSE Security Updates · Apr 25, 2026
SUSE-SU-2026:1581-1 Security update for go1.25-openssl SUSE / openSUSE Security Updates · Apr 25, 2026
openSUSE-SU-2026:20571-1 Security update for go1.26 SUSE / openSUSE Security Updates · Apr 22, 2026
openSUSE-SU-2026:20570-1 Security update for go1.25 SUSE / openSUSE Security Updates · Apr 22, 2026
SUSE-SU-2026:1320-1 Security update for go1.26 SUSE / openSUSE Security Updates · Apr 15, 2026
SUSE-SU-2026:1321-1 Security update for go1.25 SUSE / openSUSE Security Updates · Apr 15, 2026
openSUSE-SU-2026:10525-1 go1.26-1.26.2-1.1 on GA media SUSE / openSUSE Security Updates · Apr 11, 2026
openSUSE-SU-2026:10514-1 go1.25-1.25.9-1.1 on GA media SUSE / openSUSE Security Updates · Apr 10, 2026

EUVD	v3.1	5.5
CISA-ADP	v3.1	5.5

Unbounded allocation for old GNU sparse in archive/tar

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

SUSE

openSUSE

Alpine

Amazon Linux

Azure Linux

Wolfi

Affected packages

Advisories 40

References