CVE-2026-6103
Last modified
CVE-2026-6103 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 8.2.0, < 8.2.34 |
| Php | Php | >= 8.3.0, < 8.3.35 |
| Php | Php | >= 8.4.0, < 8.4.26 |
| Php | Php | >= 8.5.0, < 8.5.11 |
References
- https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85Vendor Advisory, Exploit
- https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85Vendor Advisory, Exploit
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-6103?
How severe is CVE-2026-6103?
How do I fix CVE-2026-6103?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-61024Vulnerability in the Oracle iRecruitment product of Oracle E…8.1
- CVE-2026-61025Vulnerability in the Oracle iRecruitment product of Oracle E…7.2
- CVE-2026-61026Vulnerability in the Oracle iRecruitment product of Oracle E…7.5
- CVE-2026-61027Vulnerability in the Oracle Cost Management product of Oracl…7.2
- CVE-2026-61028Vulnerability in the Oracle Inventory Management product of …1.9
- CVE-2026-61029Vulnerability in the Oracle WebCenter Sites product of Oracl…9
- CVE-2026-61030Vulnerability in the Oracle Process Manufacturing Product De…8.1
- CVE-2026-61031Vulnerability in the Oracle Financials Common Country produc…8.1
- CVE-2026-61032Vulnerability in the Oracle WebCenter Sites product of Oracl…8.8
- CVE-2026-61033Vulnerability in the Oracle WebCenter Sites product of Oracl…8.6
- CVE-2026-61034Vulnerability in the Oracle WebCenter Sites product of Oracl…9.1
- CVE-2026-61035Vulnerability in the Oracle Financials for the Americas prod…7.2
Are you affected by CVE-2026-6103?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST