CVE catalog

CVE-2021-20193

tar: CVE-2021-20193

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Published: Jan 17, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.09% · Oct 25, 2026

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	tar	sid	`1.35+dfsg-7`	fixed
Debian	tar	forky	`1.35+dfsg-6`	fixed
Debian	tar	trixie	`1.35+dfsg-3.1`	fixed
Debian	tar	bookworm	`1.34+dfsg-1.2+deb12u1`	fixed
Cpe	tar	Not reported	Not reported	unknown
Alpine	tar	3.10	`1.32-r1`	fixed
Alpine	tar	3.11	`1.32-r2`	fixed
Alpine	tar	3.12	`1.32-r2`	fixed
Alpine	tar	3.13	`1.34-r0`	fixed
Alpine	tar	3.14	`1.34-r0`	fixed
Alpine	tar	3.15	`1.34-r0`	fixed
Alpine	tar	3.16	`1.34-r0`	fixed
Alpine	tar	3.17	`1.34-r0`	fixed
Alpine	tar	3.18	`1.34-r0`	fixed
Alpine	tar	3.19	`1.34-r0`	fixed
Alpine	tar	3.20	`1.34-r0`	fixed
Alpine	tar	3.21	`1.34-r0`	fixed
Alpine	tar	3.22	`1.34-r0`	fixed
Alpine	tar	3.23	`1.34-r0`	fixed
Alpine	tar	3.24	`1.34-r0`	fixed
Ubuntu	tar	pro	`1.27.1-2`	vulnerable
Ubuntu	tar	pro	`1.28-2ubuntu1`	vulnerable
Ubuntu	tar	pro	`1.28-2.1`	vulnerable
Ubuntu	tar	pro	`1.28-2.1ubuntu0.1`	vulnerable
Ubuntu	tar	pro	`1.28-2.1ubuntu0.2`	vulnerable
Ubuntu	tar	pro	`1.28-2.1ubuntu0.2+esm1`	fixed
Ubuntu	tar	18.04	`1.29b-2`	vulnerable
Ubuntu	tar	18.04	`1.29b-2ubuntu0.1`	vulnerable
Ubuntu	tar	18.04	`1.29b-2ubuntu0.2`	vulnerable
Ubuntu	tar	18.04	`1.29b-2ubuntu0.3`	fixed
Ubuntu	tar	20.04	`1.30+dfsg-6`	vulnerable
Ubuntu	tar	20.04	`1.30+dfsg-7`	vulnerable
Ubuntu	tar	20.04	`1.30+dfsg-7ubuntu0.20.04.1`	vulnerable
Ubuntu	tar	20.04	`1.30+dfsg-7ubuntu0.20.04.2`	fixed
Opensuse	tar	leap 15.2	`1.30-lp152.4.3.1`	fixed
Suse	tar	linux enterprise server 12 sp5	`1.27.1-15.9.1`	fixed
Suse	tar	linux enterprise server for sap applications 12 sp5	`1.27.1-15.9.1`	fixed
Opensuse	tar	tumbleweed	`1.34-5.1`	fixed
Ubuntu	tar	pro	`1.27.1-2`	vulnerable
Ubuntu	tar	pro	`1.28-2ubuntu1`	vulnerable
Ubuntu	tar	pro	`1.28-2.1`	vulnerable
Ubuntu	tar	pro	`1.28-2.1ubuntu0.1`	vulnerable
Ubuntu	tar	pro	`1.28-2.1ubuntu0.2`	vulnerable
Ubuntu	tar	pro	`1.28-2.1ubuntu0.2+esm1`	fixed
Ubuntu	tar	18.04	`1.29b-2`	vulnerable
Ubuntu	tar	18.04	`1.29b-2ubuntu0.1`	vulnerable
Ubuntu	tar	18.04	`1.29b-2ubuntu0.2`	vulnerable
Ubuntu	tar	18.04	`1.29b-2ubuntu0.3`	fixed
Ubuntu	tar	20.04	`1.30+dfsg-6`	vulnerable
Ubuntu	tar	20.04	`1.30+dfsg-7`	vulnerable
Ubuntu	tar	20.04	`1.30+dfsg-7ubuntu0.20.04.1`	vulnerable
Ubuntu	tar	20.04	`1.30+dfsg-7ubuntu0.20.04.2`	fixed
Ubuntu	tar	22.04	`1.34+dfsg-1build1`	fixed
Suse	tar	linux enterprise module for basesystem 15 sp2	`1.30-3.6.1`	fixed
Suse	tar	linux enterprise micro 5.0	`1.30-3.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	tar	source	sid	`1.34+dfsg-1`	unimportant	Not reported	[980525]
Debian	tar	source	forky	`1.34+dfsg-1`	unimportant	Not reported	[980525]
Debian	tar	source	trixie	`1.34+dfsg-1`	unimportant	Not reported	[980525]
Debian	tar	source	bookworm	`1.34+dfsg-1`	unimportant	Not reported	[980525]
Alpine	tar	apk	3.10	`1.32-r1`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.11	`1.32-r2`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.12	`1.32-r2`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.13	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.14	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.15	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.16	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.17	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.18	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.19	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.20	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.21	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.22	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.23	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Alpine	tar	apk	3.24	`1.34-r0`	Not reported	ALPINE-CVE-2021-20193	Not reported
Ubuntu	tar	deb	pro	`1.28-2.1ubuntu0.2+esm1`	Not reported	USN-5329-1	Not reported
Ubuntu	tar	deb	18.04	`1.29b-2ubuntu0.3`	Not reported	USN-5329-1	Not reported
Ubuntu	tar	deb	20.04	`1.30+dfsg-7ubuntu0.20.04.2`	Not reported	USN-5329-1	Not reported
Opensuse	tar	rpm	leap 15.2	`1.30-lp152.4.3.1`	Not reported	OPENSUSE-SU-2021:0494-1	Not reported
Suse	tar	rpm	linux enterprise server 12 sp5	`1.27.1-15.9.1`	Not reported	SUSE-SU-2021:0975-1	Not reported
Suse	tar	rpm	linux enterprise server for sap applications 12 sp5	`1.27.1-15.9.1`	Not reported	SUSE-SU-2021:0975-1	Not reported
Opensuse	tar	rpm	tumbleweed	`1.34-5.1`	Not reported	OPENSUSE-SU-2024:11620-1	Not reported
Ubuntu	tar	deb	pro	`1.28-2.1ubuntu0.2+esm1`	Not reported	UBUNTU-CVE-2021-20193	Not reported
Ubuntu	tar	deb	18.04	`1.29b-2ubuntu0.3`	Not reported	UBUNTU-CVE-2021-20193	Not reported
Ubuntu	tar	deb	20.04	`1.30+dfsg-7ubuntu0.20.04.2`	Not reported	UBUNTU-CVE-2021-20193	Not reported
Ubuntu	tar	deb	22.04	`1.34+dfsg-1build1`	Not reported	UBUNTU-CVE-2021-20193	Not reported
Suse	tar	rpm	linux enterprise module for basesystem 15 sp2	`1.30-3.6.1`	Not reported	SUSE-SU-2021:0974-1	Not reported
Suse	tar	rpm	linux enterprise micro 5.0	`1.30-3.6.1`	Not reported	SUSE-SU-2021:0974-1	Not reported

[Debian bug #980525]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[tar-backup-scripts]Unknown
Source package: [tar]
Details (1)
- 1.35-10.1 · noarch · tumbleweed
  Unknown · Fixed: 1.34-5.1
  Version impact unknown
  dsa · tar · opensuse · tumbleweed
[tar-doc]Unknown
Source package: [tar]
Details (1)
- 1.35-10.1 · noarch · tumbleweed
  Unknown · Fixed: 1.34-5.1
  Version impact unknown
  dsa · tar · opensuse · tumbleweed
[tar-lang]Unknown
Source package: [tar]
Details (1)
- 1.35-10.1 · noarch · tumbleweed
  Unknown · Fixed: 1.34-5.1
  Version impact unknown
  dsa · tar · opensuse · tumbleweed
[tar-rmt]Unknown
Source package: [tar]
Details (1)
- 1.35-10.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34-5.1
  Version impact unknown
  dsa · tar · opensuse · tumbleweed
[tar-tests]Unknown
Source package: [tar]
Details (1)
- 1.35-10.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34-5.1
  Version impact unknown
  dsa · tar · opensuse · tumbleweed
[tar]Fixed
Source package: [tar]
Details (1)
- 1.35-10.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.34-5.1
  dsa · tar · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[tar]Fixed
Details (2)
- 1.34+dfsg-1.2+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.34+dfsg-1
  dsa · tar · debian · bookworm
- 1.34+dfsg-1.2+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.34+dfsg-1
  dsa · tar · debian · bookworm
[tar-scripts]Fixed
Source package: [tar]
Details (2)
- 1.34+dfsg-1.2+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.34+dfsg-1
  dsa · tar · debian · bookworm
- 1.34+dfsg-1.2+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.34+dfsg-1
  dsa · tar · debian · bookworm

Observed: Oct 23, 2026, 5:54:09 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]