Pavel Cahyna <[email protected]> writes: > Hello and sorry for the late reply, thank you for the report. By the way: > > On Sat, Oct 31, 2026 at 07:20:29AM +0000, apex-security-research wrote: > >> There is no CVE for this root; CVE-2026-5704 is the typeflag one. I am >> happy to >> request one, or to leave it to you. If one is requested, Vahagn Vardanian >> reported this root first and should be named as the reporter. > > Not sure what you mean by "for this root", but FYI we (Red Hat) reserved > CVE-2026-18082 for this problem that Vahagn Vardanian found, it is just > not published yet, so you don't see it. I believe the severity should be > same as for CVE-2026-5704, which has a very similar impact, I would not > call it a RCE (contrary to the original report). > > I am not a maintainer of GNU tar so I can not comment on the suitability > of the patches for inclusion.
Did Red Hat confirm the findings posted by Vahagn Vardanian before assigning the CVE? I am not a GNU tar maintainer, but I follow most of the messages posted on list. I found that his report contained a ton of slop, as I mentioned on oss-security [1]. It is becoming quite difficult for me to track all of the LLM generated submissions, to be quite honested. Collin [1] https://seclists.org/oss-sec/2026/q2/108
