CVE-2026-115398
CVE-2026-115398 · Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
CVSS 6.8 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
ghidra
- Versiones
- ≥ 0, < 12.2: Afectada (custom)
Actualiza a 12.2
Fuentes originales
- https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-vvp8-22p8-x954
- https://github.com/NationalSecurityAgency/ghidra/commit/061ec06a79f4147267f6fc690b0dcf944b2d4957
- https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.2_build
- https://github.com/NationalSecurityAgency/ghidra
- https://www.vulncheck.com/advisories/ghidra-before-12.2-denial-of-service-via-tar-and-zip-file-system-mount
- https://nvd.nist.gov/vuln/detail/CVE-2026-115398