fix: guard ReadTarEntry against decompression bombs (OOM)#2593

Open

jkutner wants to merge 1 commit into

mainfrom

fix/decompression-bomb-oom

Commits on May 7, 2026

Fix CVSS 3.1: 6.5 - pack OOM via decompression bomb in buildpack descriptor read
jkutner
committed