CVE-2026-115398
CVE-2026-115398 · Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
CVSS 6.8 · Mittel · EPSS 0,2% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
ghidra
- Softwareversionen
- ≥ 0, < 12.2: Betroffen (custom)
Auf 12.2 aktualisieren
Originalquellen
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954
- https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
- https://github.com/NationalSecurityAgency/ghidra
- https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount
- https://nvd.nist.gov/vuln/detail/CVE-2026-115398