Linux · Security advisory · September 11, 2026
RLSA-2026:61586: tar security update
RLSA-2026:61586, released September 11, 2026, fixes 3 CVEs in tar (version 2:1.35-13.el10_2). None of them is reported as exploited. Patch Radar priority: Routine.
Routine
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0045
39th percentile
Priority of the 3 CVEs
Patch now 0
Urgent 0
High 0
Routine 3
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| tar | rocky 10 | 2:1.35-13.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Routine | CVE-2026-5704 | tar: A flaw was found in tar | 5.6 | 0.0045 | None reported | |
| Routine | CVE-2026-18508 | Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | 5.6 | 0.0014 | None reported | |
| Routine | CVE-2026-18477 | Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape | 5.6 | 0.0008 | None reported |
Showing 1 to 3 of 3
1