CVE-2025-60753: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This vulnerability was disclosed on November 5, 2025, and affects the libarchive package across multiple operating systems and distributions (NVD).

The vulnerability occurs in the apply_substitution function within tar/subst.c when processing -s substitution rules. The issue involves unbounded memory allocation that can lead to resource exhaustion. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The weakness is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-835 (Loop with Unreachable Exit Condition) (Snyk).

When exploited, this vulnerability can cause unbounded memory allocation leading to a denial of service condition through an Out-of-Memory crash. This affects the system's availability by potentially causing the service to become completely unresponsive (NVD).

The vulnerability is fixed in libarchive bsdtar version 3.8.1. Users are advised to upgrade to this version or later to mitigate the issue. Currently, there are no known workarounds for affected versions (NVD).