GITHUB.COM/BLAKESMITH/AR · GO-2026-6905 · Package
NO FIX YET
The github.com/blakesmith/ar Go package accepts a negative member size in an archive header. Reading that member makes the program panic with a slice bounds error, which crashes any code that parses untrusted ar archives.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that import github.com/blakesmith/ar and call Reader.Next and Reader.Read on archive files supplied from outside the team, such as uploaded .deb or .a files. Programs that only read archives they create themselves, or never parse untrusted input, are unlikely to be exposed. The sources do not state a fixed version.
Not affected if no-ar-parsing, trusted-input-only
Who cares ar-archives, deb-parsing, go
github.com/blakesmith/ar with go list -m github.com/blakesmith/arUnknown from the sources.
Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.