diff --git a/NEWS b/NEWS
index faee75f69429..275520768906 100644
--- a/NEWS
+++ b/NEWS
@@ -90,6 +90,10 @@ PHP                                                                        NEWS
   . Reverted the validity check on the flags argument of posix_access().
     (David Carlier)
 
+- Phar:
+  . Fixed bug GH-22556 (OOM DoS via oversized ././@LongLink entry in TAR phar).
+    (crystarm)
+
 - Readline:
   . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
     set to an empty string. (Ilia Alshanetsky)
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index 3ab23c81cc0a..ee27a38478e4 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -441,8 +441,10 @@ zend_result phar_parse_tarfile(
 			last_was_longlink = true;
 			/* support the ././@LongLink system for storing long filenames */
 
-			/* Check for overflow - bug 61065 */
-			if (entry.uncompressed_filesize == 0 || entry.uncompressed_filesize > totalsize) {
+			/* Check for empty, truncated, or excessively large ././@LongLink filename entries - bug 61065 */
+			if (entry.uncompressed_filesize == 0
+					|| entry.uncompressed_filesize > totalsize
+					|| entry.uncompressed_filesize > UINT16_MAX) {
 				if (error) {
 					spprintf(error, 4096, "phar error: \"%s\" is a corrupted tar file (invalid entry size)", fname);
 				}