Vulnerability GO-2026-6905
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:55 PM UTC
Panic on negative member size in Reader.Read in github.com/blakesmith/ar
*
*
Summary
Panic on negative member size in Reader.Read in github.com/blakesmith/ar
Details
Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.
References
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:55 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC