CVE-2026-32288: 
Go vulnerability analysis and mitigation

CVE-2026-32288 is a denial-of-service vulnerability in Go's archive/tar standard library package, where tar.Reader can allocate an unbounded amount of memory when processing a maliciously crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. It affects all Go versions before 1.25.9 and versions 1.26.0 through 1.26.1. The vulnerability was published on April 8, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Go Vuln DB).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). When tar.Reader parses the "old GNU sparse map" header format, it does not impose any upper bound on the number of sparse region entries it will allocate memory for, allowing a crafted archive to trigger unbounded heap growth. Exploitation requires local access and user interaction — specifically, a user or application must open and process the malicious tar file. The fix is tracked in Go change list CL 763766 and issue #78301 (GitHub Advisory, Go Vuln DB).

Successful exploitation causes the affected application to exhaust available system memory, leading to application crashes or system instability — a denial-of-service condition. There is no confidentiality or integrity impact; only availability is affected. Applications that process untrusted tar archives using Go's standard library are at risk, including container runtimes, build systems, backup tools, and cloud-native infrastructure components that bundle Go binaries (GitHub Advisory, Go Vuln DB).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.009% (0th percentile), indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (processing a crafted tar file), which further limits opportunistic attack scenarios (GitHub Advisory).

1. Craft malicious archive: Create a tar archive that encodes a very large number of sparse region entries using the "old GNU sparse map" format in the tar header, without a corresponding large file payload.
2. Deliver the archive: Distribute the crafted .tar file to a target user or system that processes tar archives using a Go application (e.g., via email attachment, file upload endpoint, package repository, or supply chain injection).
3. Trigger processing: Induce the target application to open and parse the archive using Go's archive/tar tar.Reader. This may happen automatically in CI/CD pipelines, backup agents, or container image builders.
4. Memory exhaustion: As tar.Reader iterates over the sparse map entries without bounds checking, it allocates memory for each entry, rapidly exhausting available RAM and causing the process or host to crash or become unresponsive (GitHub Advisory, Go Vuln DB).

• Process Behavior: Go application processes consuming abnormally high or rapidly growing memory (RSS) before crashing; OOM-killer events in system logs (dmesg or /var/log/syslog) attributable to Go application processes.
• Logs: Application crash logs or stack traces referencing archive/tar or tar.Reader; out-of-memory errors in container runtime logs (e.g., Docker, containerd).
• File System: Presence of unexpected or externally sourced .tar files in directories processed by automated pipelines or upload handlers.
• Network: Unusual file transfers delivering tar archives to systems running vulnerable Go versions, particularly in CI/CD or build infrastructure contexts.

Update Go to version 1.25.9 or later (for the 1.25.x release line) or 1.26.2 or later (for the 1.26.x release line). The patch is available via the official Go change list at https://go.dev/cl/763766. As interim mitigations, restrict tar file processing to trusted sources only, and apply memory quotas or cgroup limits at the container or process level to prevent a single process from exhausting system memory. Downstream products such as IBM Instana Observability and IBM App Connect Enterprise Certified Container have also released updated advisories (Go Vuln DB, IBM Advisory).

The Go team announced the vulnerability via the golang-announce mailing list and published a fix through the standard Go security advisory process (golang-announce). Downstream projects including rclone, Portainer, oauth2-proxy, grpc-health-probe, Tailscale's Go fork, and Docker (Moby) have released updated versions incorporating the patched Go runtime. OpenSUSE, Amazon Linux 2, Amazon Linux 2023, and Yocto Project security lists have also issued advisories. Microsoft acknowledged the vulnerability in its Security Response Center update guide (Microsoft MSRC).