Loading story…
A critical denial-of-service vulnerability in the widely used node-tar package, tracked as CVE-2026-59873, allows crafted gzipped tar archives to trigger unbounded decompression and consume massive CPU and disk resources. The flaw affects versions up to and including 7.5.18, where missing limits on total decompressed output and archive entry handling let a small gzip bomb expand into gigabytes of data, potentially crashing services that automatically process untrusted tar files.
The issue is described as remotely triggerable without authentication or user interaction when applications parse attacker-controlled archives. Reported impacts include storage exhaustion, sustained 100% CPU utilization, and service failure. The vulnerability is mapped to CWE-770 and carries a CVSS 4.0 score of 9.2 from GHSA; it is patched in node-tar version 7.5.19, which adds compressed-versus-decompressed byte tracking and aborts extraction when a maximum decompression ratio is exceeded.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability affecting node-tar versions up to and including 7.5.18 was patched in version 7.5.19. The fix adds compressed-versus-decompressed byte tracking and aborts extraction when a maximum decompression ratio is exceeded.
A denial-of-service flaw tracked as CVE-2026-59873 was disclosed in the node-tar library. The issue allows crafted gzipped tar archives to trigger unbounded decompression, potentially exhausting CPU and disk resources and crashing services that process untrusted archives.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026
A critical global buffer overflow vulnerability has been identified in the *zlib* untgz utility, specifically affecting version 1.3.1.2. The flaw resides in the `TGZfname()` function, where an unbounded `strcpy()` operation copies user-supplied archive names from command-line arguments into a fixed-size global buffer of 1,024 bytes without proper length validation. Security researchers demonstrated that supplying an archive name exceeding this limit can trigger an out-of-bounds write, leading to memory corruption, denial-of-service, or potentially arbitrary code execution, depending on system configuration and compiler settings. The vulnerability, tracked as `CVE-2026-22184` with a CVSS score of 9.3, is trivially exploitable via command-line input and does not require any archive parsing or validation to trigger. Successful exploitation was confirmed using AddressSanitizer, which detected a global buffer overflow when the utility was invoked with a 4,096-byte filename. The issue is classified under CWE-120 (Buffer Copy without Checking Size of Input) and poses significant risk to systems utilizing the affected version of the untgz utility for archive extraction or processing.
Jun 29, 2026
A flaw in GNU tar 1.35 allows a crafted archive to show one set of contents during listing while extracting additional hidden files. The issue stems from a desynchronization between `tar -t` and `tar -x`: listing honors the size field for some non-data-bearing typeflags and skips data blocks, while extraction ignores that size and treats the same blocks as new headers. Researchers said the behavior affects symlink, character device, block device, and FIFO entries, but not directory entries, enabling hidden file injection with an archive reportedly smaller than 3 KB. The bug was disclosed on the GNU `bug-tar` and `oss-sec` mailing lists, where Red Hat was reported to have assigned **CVE-2026-5704**. A patch from GNU tar maintainer Paul Eggert was published to the GNU tar mailing list and committed to the upstream repository. Follow-up discussion on `oss-sec` also noted maintainer skepticism about parts of the original report and broader concerns about low-quality, possibly LLM-generated vulnerability submissions, but the technical issue and upstream fix were separately referenced in the disclosure and source commit.
Jun 29, 2026