Uncontrolled Recursion in tar - CVE-2026-73566
Published: July 26, 2026 / Updated: August 16, 2026
Vulnerability identifier: #VU139375
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73566
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in the mapHas helper used by filesFilter when processing a crafted tar archive with a non-empty member-selection list. A remote attacker can supply a specially crafted archive with a long path to cause a denial of service.
On async and streaming consumers, the resulting stack overflow raises an uncaught RangeError that terminates the Node process. The issue is triggered when listing or extracting selected members from an untrusted archive.
Affected software
tar
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
Informix Dynamic Server
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
Informix Dynamic Server
How to mitigate CVE-2026-73566
Install security update from vendor's website.
tar - update to 7.5.21
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Jira Service Management Data Center - addressed in versions 10.3.18, 11.3.10
Jira Software Data Center - addressed in versions 10.3.18, 11.3.11
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Jira Service Management Data Center - addressed in versions 10.3.18, 11.3.10
Jira Software Data Center - addressed in versions 10.3.18, 11.3.11
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16