diff --git a/package/tar/tar.mk b/package/tar/tar.mk
index 1a8e4369de..c512d13ef1 100644
--- a/package/tar/tar.mk
+++ b/package/tar/tar.mk
@@ -13,6 +13,8 @@ TAR_CONF_OPTS = --exec-prefix=/
 TAR_LICENSE = GPL-3.0+
 TAR_LICENSE_FILES = COPYING
 TAR_CPE_ID_VENDOR = gnu
+# only tar <= 1.16
+TAR_IGNORE_CVES += CVE-2007-4476
 
 # 0001-Fix-memory-leak-in-read_header.patch
 TAR_IGNORE_CVES += CVE-2021-20193