CVE-2025-58183
Vulnerability Summary
Timeline
Description
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVSS Metrics
- v3.1•MEDIUM•Score: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 0.41%• Percentile: 35%
Affected Systems
- chainguard•age
< 1.2.1-r8
- chainguard•age-fips
< 1.2.1-r8
- chainguard•amass
< 5.0.1-r1
- chainguard•amazon-k8s-cni-fips
< 1.20.4-r2
- chainguard•amazon-k8s-cni-init-fips
< 1.20.4-r2
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.20.4-r2
- chainguard•ansible-operator
< 1.41.0-r1
- chainguard•ansible-operator-compat
< 1.41.0-r1
- chainguard•apisix-ingress-controller
< 1.8.4-r4
- chainguard•apisix-ingress-controller-compat
< 1.8.4-r4
- chainguard•apisix-ingress-controller-iamguarded-compat
< 1.8.4-r4
- chainguard•apm-server-7.17
< 7.17.29-r4
- chainguard•apm-server-7.17-compat
< 7.17.29-r4
- chainguard•apm-server-8.17
< 8.17.10-r2
- chainguard•apm-server-8.17-compat
< 8.17.10-r2
- chainguard•apm-server-8.18
< 8.18.8-r1
- chainguard•apm-server-8.18-compat
< 8.18.8-r1
- chainguard•apm-server-fips-7.17
< 7.17.29-r4
- chainguard•apm-server-fips-7.17-compat
< 7.17.29-r4
- chainguard•apm-server-fips-8.17
< 8.17.10-r1
- chainguard•apm-server-fips-8.17-compat
< 8.17.10-r1
- chainguard•apm-server-fips-8.18
< 8.18.8-r1
- chainguard•apm-server-fips-8.18-compat
< 8.18.8-r1
- chainguard•apm-server-fips-9.0
< 9.0.8-r1
- chainguard•apm-server-fips-9.0-compat
< 9.0.8-r1
- chainguard•argo-cd-2.13-compat
< 2.13.9-r2
- chainguard•argo-rollouts
< 1.8.3-r4
- chainguard•argo-rollouts-fips
< 1.8.3-r5
- chainguard•atlantis
< 0.36.0-r2
- chainguard•auditbeat-fips-8.17
< 8.17.10-r2
- chainguard•auditbeat-fips-8.18
< 8.18.8-r2
- chainguard•auditbeat-fips-9.0
< 9.0.8-r2
- chainguard•authservice-fips
< 1.1.1-r1
- chainguard•authservice-fips-compat
< 1.1.1-r1
- chainguard•aws-iam-authenticator
< 0.7.8-r1
- chainguard•aws-iam-authenticator-fips
< 0.7.8-r1
- chainguard•aws-node-termination-handler
< 1.25.2-r2
- chainguard•aws-node-termination-handler-compat
< 1.25.2-r2
- chainguard•aws-node-termination-handler-fips
< 1.25.2-r2
- chainguard•aws-node-termination-handler-fips-compat
< 1.25.2-r2
- chainguard•aws-privateca-issuer-compat-fips
< 1.7.0-r3
- chainguard•aws-privateca-issuer-fips
< 1.7.0-r3
- chainguard•aws-s3-controller
< 1.1.1-r1
- chainguard•aws-signer-notation-plugin
< 1.0.2292-r3
- chainguard•aws-signer-notation-plugin-fips
< 1.0.2292-r3
- chainguard•aws-sigv4-proxy
< 1.10-r3
- chainguard•aws-sigv4-proxy-compat
< 1.10-r3
- chainguard•aws-sigv4-proxy-fips
< 1.10-r3
- chainguard•aws-sigv4-proxy-fips-compat
< 1.10-r3
- chainguard•azure-aad-pod-identity-mic
< 1.8.17-r28
Showing first 50 affected entries in server-rendered view.
References (107)
- https://go.dev/cl/709861
- https://go.dev/issue/75677
- https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
- https://pkg.go.dev/vuln/GO-2025-4014
- http://www.openwall.com/lists/oss-security/2025/10/08/1
- https://access.redhat.com/errata/RHSA-2025:21778
- https://access.redhat.com/security/updates/classification/#moderate
- https://bugzilla.redhat.com/show_bug.cgi?id=2407258
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21778.json
- https://access.redhat.com/security/cve/CVE-2025-58183
- https://www.cve.org/CVERecord?id=CVE-2025-58183
- https://nvd.nist.gov/vuln/detail/CVE-2025-58183
- https://access.redhat.com/errata/RHSA-2025:21779
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21779.json
- https://access.redhat.com/errata/RHSA-2025:21815
- https://issues.redhat.com/browse/RHEL-117130
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21815.json
- https://access.redhat.com/errata/RHSA-2025:21816
- https://issues.redhat.com/browse/RHEL-117127
- https://issues.redhat.com/browse/RHEL-117132
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21816.json
- https://access.redhat.com/errata/RHSA-2025:21964
- https://issues.redhat.com/browse/RHEL-129120
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21964.json
- https://access.redhat.com/errata/RHSA-2025:22255
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22255.json
- https://access.redhat.com/errata/RHSA-2025:23001
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23001.json
- https://access.redhat.com/errata/RHSA-2025:23002
- https://issues.redhat.com/browse/RHEL-132758
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23002.json
- https://access.redhat.com/errata/RHSA-2025:23087
- https://issues.redhat.com/browse/RHEL-120426
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23087.json
- https://access.redhat.com/errata/RHSA-2025:23088
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23088.json
- https://access.redhat.com/errata/RHSA-2025:23294
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23294.json
- https://access.redhat.com/errata/RHSA-2025:23295
- https://issues.redhat.com/browse/RHEL-132532
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23295.json
- https://access.redhat.com/errata/RHSA-2025:23325
- https://issues.redhat.com/browse/RHEL-132531
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23325.json
- https://access.redhat.com/errata/RHSA-2025:23326
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23326.json
- https://access.redhat.com/errata/RHSA-2025:23348
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23348.json
- https://access.redhat.com/errata/RHSA-2025:23374
- https://issues.redhat.com/browse/RHEL-132818
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23374.json
- https://access.redhat.com/errata/RHSA-2025:23394
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23394.json
- https://access.redhat.com/errata/RHSA-2025:23736
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23736.json
- https://access.redhat.com/errata/RHSA-2025:23746
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23746.json
- https://access.redhat.com/errata/RHSA-2025:23747
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23747.json
- https://access.redhat.com/errata/RHSA-2025:23948
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23948.json
- https://access.redhat.com/errata/RHSA-2026:0226
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0226.json
- https://access.redhat.com/errata/RHSA-2026:0227
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0227.json
- https://access.redhat.com/errata/RHSA-2026:0243
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0243.json
- https://access.redhat.com/errata/RHSA-2026:0244
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0244.json
- https://access.redhat.com/errata/RHSA-2026:0245
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0245.json
- https://access.redhat.com/errata/RHSA-2026:0246
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0246.json
- https://access.redhat.com/errata/RHSA-2026:0314
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0314.json
- https://access.redhat.com/errata/RHSA-2026:0477
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0477.json
- https://access.redhat.com/errata/RHSA-2026:0973
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0973.json
- https://access.redhat.com/errata/RHSA-2026:0987
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0987.json
- https://access.redhat.com/errata/RHSA-2026:1025
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1025.json
- https://access.redhat.com/errata/RHSA-2026:1377
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1377.json
- https://access.redhat.com/errata/RHSA-2026:1378
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1378.json
- https://access.redhat.com/errata/RHSA-2026:1379
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1379.json
- https://access.redhat.com/errata/RHSA-2026:1380
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1380.json
- https://access.redhat.com/errata/RHSA-2026:1381
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1381.json
- https://access.redhat.com/errata/RHSA-2026:1837
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1837.json
- https://access.redhat.com/errata/RHSA-2026:1838
- https://issues.redhat.com/browse/RHEL-137212
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1838.json
- https://access.redhat.com/errata/RHSA-2026:2071
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2071.json
- https://access.redhat.com/errata/RHSA-2026:2082
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2082.json
- https://access.redhat.com/errata/RHSA-2026:5086
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5086.json
- https://access.redhat.com/errata/RHSA-2026:5234
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5234.json
- https://security-tracker.debian.org/tracker/CVE-2025-58183