diff --git a/archive/tar/reader.go b/archive/tar/reader.go
index c72e002..0b0c3b1 100644
--- a/archive/tar/reader.go
+++ b/archive/tar/reader.go
@@ -553,6 +553,10 @@ func (tr *Reader) readHeader() *Header {
 	hdr.Uid = int(tr.octal(s.next(8)))
 	hdr.Gid = int(tr.octal(s.next(8)))
 	hdr.Size = tr.octal(s.next(12))
+	if hdr.Size < 0 {
+		tr.err = ErrHeader
+		return nil
+	}
 	hdr.ModTime = time.Unix(tr.octal(s.next(12)), 0)
 	s.next(8) // chksum
 	hdr.Typeflag = s.next(1)[0]
diff --git a/archive/tar/reader_test.go b/archive/tar/reader_test.go
index 9601ffe..ab1e844 100644
--- a/archive/tar/reader_test.go
+++ b/archive/tar/reader_test.go
@@ -741,3 +741,19 @@ func TestUninitializedRead(t *testing.T) {
 	}
 
 }
+
+// Negative header size should not cause panic.
+// Issues 10959 and 10960.
+func TestNegativeHdrSize(t *testing.T) {
+	f, err := os.Open("testdata/neg-size.tar")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	r := NewReader(f)
+	_, err = r.Next()
+	if err != ErrHeader {
+		t.Error("want ErrHeader, got", err)
+	}
+	io.Copy(ioutil.Discard, r)
+}
diff --git a/archive/tar/testdata/neg-size.tar b/archive/tar/testdata/neg-size.tar
new file mode 100644
index 0000000..5deea3d
Binary files /dev/null and b/archive/tar/testdata/neg-size.tar differ