diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index ee27a38478e..c48061740e2 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -604,7 +604,7 @@ bail:
 		}
 
 		if (zend_string_starts_with_literal(entry.filename, ".phar/.metadata")) {
-			if (FAILURE == phar_tar_process_metadata(newentry, fp)) {
+			if (size > totalsize || FAILURE == phar_tar_process_metadata(newentry, fp)) {
 				if (error) {
 					spprintf(error, 4096, "phar error: tar-based phar \"%s\" has invalid metadata in magic file \"%s\"", fname, ZSTR_VAL(entry.filename));
 				}
diff --git a/ext/phar/tests/tar/gh24740.phpt b/ext/phar/tests/tar/gh24740.phpt
new file mode 100644
index 00000000000..e42a38567d1
--- /dev/null
+++ b/ext/phar/tests/tar/gh24740.phpt
@@ -0,0 +1,44 @@
+--TEST--
+GH-24740 (Unbounded size of .phar/.metadata* entry in TAR phar)
+--EXTENSIONS--
+phar
+--INI--
+memory_limit=16M
+--FILE--
+<?php
+function tar_header(string $name, int $size): string
+{
+    $header = str_repeat("\0", 512);
+    $header = substr_replace($header, $name, 0, strlen($name));
+    $header = substr_replace($header, sprintf("%07o\0", 0644), 100, 8);
+    $header = substr_replace($header, sprintf("%07o\0", 0), 108, 8);
+    $header = substr_replace($header, sprintf("%07o\0", 0), 116, 8);
+    $header = substr_replace($header, sprintf("%011o\0", $size), 124, 12);
+    $header = substr_replace($header, sprintf("%011o\0", 1700000000), 136, 12);
+    $header[156] = '0';
+    $header = substr_replace($header, "ustar\0", 257, 6);
+    $header = substr_replace($header, "00", 263, 2);
+
+    $checksum = 0;
+    for ($i = 0; $i < 512; $i++) {
+        $checksum += ($i >= 148 && $i < 156) ? 0x20 : ord($header[$i]);
+    }
+
+    return substr_replace($header, sprintf("%06o\0 ", $checksum), 148, 8);
+}
+
+$fname = __DIR__ . '/gh24740.tar';
+file_put_contents($fname, tar_header('.phar/.metadata.bin', 0x7FFFFE00) . str_repeat("\0", 1024));
+
+try {
+    new PharData($fname);
+} catch (UnexpectedValueException $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh24740.tar');
+?>
+--EXPECTF--
+phar error: tar-based phar "%sgh24740.tar" has invalid metadata in magic file ".phar/.metadata.bin"