{"id":"GO-2026-6905","kind":"vulnerability","aliases":["GO-2026-6905"],"related":[],"title":"Panic on negative member size in Reader.Read in github.com/blakesmith/ar","description":"Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.","summary":"The github.com/blakesmith/ar Go package accepts a negative member size in an archive header. Reading that member makes the program panic with a slice bounds error, which crashes any code that parses untrusted ar archives.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/blakesmith/ar","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["ar-archives","deb-parsing","go","package"],"not_affected_if":["no-ar-parsing","trusted-input-only"],"how_to_check":"- Check whether the project depends on `github.com/blakesmith/ar` with `go list -m github.com/blakesmith/ar`\n- Confirm the version in use against the fixed version listed in the advisory (unknown in the sources)","fix":null,"status":"open","published_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","triaged_at":"2026-11-06T00:10:30+00:00","updated_at":"2026-11-06T00:10:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T00:10:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Go ar library: crafted archive header makes Reader.Read panic","impact":"low","summary":"The github.com/blakesmith/ar Go package accepts a negative member size in an archive header. Reading that member makes the program panic with a slice bounds error, which crashes any code that parses untrusted ar archives.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","ar-archives","deb-parsing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Crafted archive crashes the program that parses it with a panic.","analyst_note":"Confirm the affected and fixed versions of github.com/blakesmith/ar at https://pkg.go.dev/vuln/GO-2026-6905.","how_to_check":"- Check whether the project depends on `github.com/blakesmith/ar` with `go list -m github.com/blakesmith/ar`\n- Confirm the version in use against the fixed version listed in the advisory (unknown in the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-ar-parsing"],"who_is_affected":"Applications that import github.com/blakesmith/ar and call Reader.Next and Reader.Read on archive files supplied from outside the team, such as uploaded .deb or .a files. Programs that only read archives they create themselves, or never parse untrusted input, are unlikely to be exposed. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000702,"input_tokens":4233,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-6905':14A,17A '/blakesmith/ar':11A,20A,32B '10':68C 'accept':35B 'ar':22B,63B 'ar-arch':21B 'archiv':23B,42B,64B,75C 'bound':54B,110C 'buffer':120C 'byte':69C,97C 'call':102C 'caller':118C 'caus':99C 'code':59B 'count':98C 'crash':57B 'deb':25B 'deb-pars':24B 'decim':70C 'error':55B,114C 'field':72C 'github.com':10A,19A,31B 'github.com/blakesmith/ar':9A,18A,30B 'go':12A,15A,27B,33B 'header':43B,77C,85C 'leav':90C 'make':47B 'member':4A,38B,46B,76C 'negat':3A,37B,82C,88C,95C 'packag':28B,34B 'panic':1A,50B,106C 'pars':26B,61B,66C 'program':49B 'rang':113C 'read':44B 'reader':92C 'reader.next':65C 'reader.read':7A,104C 'reject':81C 'remain':96C 'size':5A,39B,71C,89C 'slice':53B,109C,116C 'strconv.parseint':79C 'subsequ':101C 'untrust':62B 'valu':83C 'without':80C","nicknames":[],"mitigations":[],"who_affected":"Applications that import github.com/blakesmith/ar and call Reader.Next and Reader.Read on archive files supplied from outside the team, such as uploaded .deb or .a files. Programs that only read archives they create themselves, or never parse untrusted input, are unlikely to be exposed. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["githubcomblakesmithar"],"ptokens":["ar","blakesmith","com","github"],"labels":["ararchives","debparsing","go","low","package"],"campaign_type":null,"first_public_at":"2026-11-05T22:55:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6905","url":"https://pkg.go.dev/vuln/GO-2026-6905","severity":null,"published_at":"2026-11-05T22:55:15+00:00","modified_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","fetched_at":"2026-11-06T00:09:14+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}