This vulnerability in the Perl module Archive::Tar allows a crafted tar header that declares an excessively large entry size to cause the program to allocate a scalar of that size. As a result, the application can exhaust system memory, leading to a denial of service. The weakness is identified as CWE‑789 (Uncontrolled Memory Allocation).

All installations of BINGOS Archive::Tar older than version 3.10 are affected. The vulnerability exists in all prior releases, regardless of minor sub‑version. Upgrading to 3.10 or later removes the unchecked size handling. Organizations using this module should audit their Perl environments for the presence of older versions.

The CVSS score is 7.5, and the EPSS score is < 1%, indicating a medium severity and a low probability of exploitation. However, the issue can be triggered by any attacker who can supply a malicious tar file to a process that uses Archive::Tar for extraction. Because the flaw involves unbounded allocation based solely on header data, it is likely to be exploitable in any context where tar extraction is performed on untrusted input. The vulnerability is listed in CISA KEV as not present, indicating no known active exploitation at this time.