CVE-2026-54417: Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS

Synopsis

An integer overflow in the mtar_next() function of rxi microtar 0.1.0 allows a remote attacker to trigger an infinite loop by sending a crafted tar archive over the network, requiring no authentication. Successful exploitation locks the affected process at 100% CPU indefinitely, causing a denial of service with no self-recovery. HarborGuard is tracking this advisory for patch availability, as no fix version has been published by the upstream maintainer.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers a crafted tar archive over the network to any service that processes tar input with the affected library, so the service must be reachable remotely.

• AuthenticationNot required

  No credentials or account are needed; the exploit is reachable by any unauthenticated party that can send input to the affected service.

• Victim interactionNot required

  No user action is required; the overflow triggers automatically when the application processes the malicious archive.

• Attack complexityDetail

  Exploitation is reliable and condition-free: crafting a header size value in the documented overflow range is straightforward arithmetic with no race condition or environmental dependency.

Blast Radius

• The affected process enters an infinite loop consuming 100% of an available CPU core with no built-in recovery path.
• Any request handling, background job, or pipeline stage that depends on the hung process is blocked for the duration of the loop.
• If the process runs without a watchdog or container restart policy, the denial of service persists until the process is manually killed or the host is rebooted.