CVE-2021-20193

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.

CVSS 3.1

3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS

1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-25)

CWEs

CWE-125, CWE-401

Published

2021-03-26

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• gnu:tar

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1917565
• https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777
• https://savannah.gnu.org/bugs/?59897
• https://security.gentoo.org/glsa/202105-29
• https://bugzilla.redhat.com/show_bug.cgi?id=1917565

Check your stackJSON