This vulnerability involves uncontrolled resource consumption (CWE-400) in the Go standard library's archive/tar package. Specifically, the tar.Reader can allocate excessive memory when handling tar archives crafted with numerous sparse regions using the old GNU sparse map format. This behavior can cause denial of service by exhausting system memory. The issue affects Go versions from initial releases up to and including 1.26.0-0. There is no confirmed patch or official fix available at this time, and no known exploitation has been observed.

An attacker who can supply a specially crafted tar archive to a Go application using the archive/tar package may cause the application to consume excessive memory, potentially leading to denial of service. There is no impact on confidentiality or integrity reported. No known exploits exist in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted tar archives containing sparse regions encoded with the old GNU sparse map format or implement application-level resource limits to mitigate potential memory exhaustion.