{"id":"GO-2026-6905","aliases":[],"status":"published","title":"Panic on negative member size in Reader.Read in github.com/blakesmith/ar","description":"Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-11-05T22:55:15Z","modified":"2026-11-05T23:15:18Z","affected":[{"source":"osv","ecosystem":"Go","package":"github.com/blakesmith/ar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/golang/vulndb/issues/6905","tags":["report"]},{"url":"https://github.com/blakesmith/ar/pull/10","tags":["web"]}],"sources":{"osv":[{"id":"GO-2026-6905","title":"Panic on negative member size in Reader.Read in github.com/blakesmith/ar","description":"Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.","status":"published","published":"2026-11-05T22:55:15Z","modified":"2026-11-05T23:15:18.148866409Z","updated_at":"2026-11-06T00:02:13.631839Z"}]}}