CVE-2025-58183: Unbounded allocation when parsing GNU sparse map in archive/tar

Deferred

AliasesRHSA-2025:21778RHSA-2025:21779RHSA-2025:21815+3996 more

Published 29-10-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-58183 is a medium (CVSS 4.3) vulnerability in go standard library archive/tar. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 55 · Related 118

MGASA-2025-0256 OPENSUSE-SU-2025:15608-1 OPENSUSE-SU-2025:15609-1 OPENSUSE-SU-2025:15695-1 OPENSUSE-SU-2025:15711-1 OPENSUSE-SU-2025:15723-1+94 more

Showing 100 of 119.

Timeline

29-10-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

CVSS metrics

6 scores · 6 sources · 1 version

v3.14.3

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.44% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

age< 1.2.1-r8
age-fips< 1.2.1-r8
amass< 5.0.1-r1
amazon-k8s-cni-fips< 1.20.4-r2
amazon-k8s-cni-init-fips< 1.20.4-r2

amazon-k8s-cni-init-fips-compat< 1.20.4-r2
ansible-operator< 1.41.0-r1
ansible-operator-compat< 1.41.0-r1
apisix-ingress-controller< 1.8.4-r4
apisix-ingress-controller-compat< 1.8.4-r4
apisix-ingress-controller-iamguarded-compat< 1.8.4-r4
apm-server-7.17< 7.17.29-r4
apm-server-7.17-compat< 7.17.29-r4
apm-server-8.17< 8.17.10-r2
apm-server-8.17-compat< 8.17.10-r2
apm-server-8.18< 8.18.8-r1
apm-server-8.18-compat< 8.18.8-r1
apm-server-fips-7.17< 7.17.29-r4
apm-server-fips-7.17-compat< 7.17.29-r4
apm-server-fips-8.17< 8.17.10-r1
apm-server-fips-8.17-compat< 8.17.10-r1
apm-server-fips-8.18< 8.18.8-r1
apm-server-fips-8.18-compat< 8.18.8-r1
apm-server-fips-9.0< 9.0.8-r1
apm-server-fips-9.0-compat< 9.0.8-r1
argo-cd-2.13-compat< 2.13.9-r2
argo-rollouts< 1.8.3-r4
argo-rollouts-fips< 1.8.3-r5
atlantis< 0.36.0-r2
auditbeat-fips-8.17< 8.17.10-r2
auditbeat-fips-8.18< 8.18.8-r2
auditbeat-fips-9.0< 9.0.8-r2
authservice-fips< 1.1.1-r1
authservice-fips-compat< 1.1.1-r1
aws-iam-authenticator< 0.7.8-r1
aws-iam-authenticator-fips< 0.7.8-r1
aws-node-termination-handler< 1.25.2-r2
aws-node-termination-handler-compat< 1.25.2-r2
aws-node-termination-handler-fips< 1.25.2-r2
aws-node-termination-handler-fips-compat< 1.25.2-r2
aws-privateca-issuer-compat-fips< 1.7.0-r3
aws-privateca-issuer-fips< 1.7.0-r3
aws-s3-controller< 1.1.1-r1
aws-signer-notation-plugin< 1.0.2292-r3
aws-signer-notation-plugin-fips< 1.0.2292-r3
aws-sigv4-proxy< 1.10-r3
aws-sigv4-proxy-compat< 1.10-r3
aws-sigv4-proxy-fips< 1.10-r3
aws-sigv4-proxy-fips-compat< 1.10-r3
azure-aad-pod-identity-mic< 1.8.17-r28
azure-aad-pod-identity-nmi< 1.8.17-r28
azure-container-networking< 1.7.4-r1
azure-ipam< 0.4.0-r4
azure-ipam-dropgz< 0.4.0-r4
azure-vnet-cni< 1.7.4-r1
azure-workload-identity-webhook< 1.5.1-r3
azure-workload-identity-webhook-compat< 1.5.1-r3
azuredisk-csi-fips-1.33< 1.33.5-r1
azurefile-csi-1.30< 1.30.10-r5
azurefile-csi-1.30-compat< 1.30.10-r5
azurefile-csi-1.31< 1.31.8-r1
azurefile-csi-1.31-compat< 1.31.8-r1
azurefile-csi-1.32< 1.32.7-r1
azurefile-csi-1.32-compat< 1.32.7-r1
azurefile-csi-1.33< 1.33.5-r1
azurefile-csi-1.33-compat< 1.33.5-r1
azurefile-csi-fips-1.29< 1.29.12-r5
azurefile-csi-fips-1.29-compat< 1.29.12-r5
azurefile-csi-fips-1.30< 1.30.10-r5
azurefile-csi-fips-1.30-compat< 1.30.10-r5
azurefile-csi-fips-1.31< 1.31.8-r1
azurefile-csi-fips-1.31-compat< 1.31.8-r1
azurefile-csi-fips-1.32< 1.32.7-r1
azurefile-csi-fips-1.32-compat< 1.32.7-r1
bazelisk< 1.27.0-r1
bazelisk-default< 1.27.0-r1
beats-fips-8.17< 8.17.10-r2
beats-fips-8.18< 8.18.8-r2
beats-fips-9.0< 9.0.8-r2
blob-csi-1.23< 1.23.11-r56
blob-csi-1.23-compat< 1.23.11-r56
blob-csi-1.24< 1.24.11-r5
blob-csi-1.24-compat< 1.24.11-r5
blob-csi-1.25< 1.25.10-r1
blob-csi-1.25-compat< 1.25.10-r1
blob-csi-fips-1.23< 1.23.11-r57
blob-csi-fips-1.23-compat< 1.23.11-r57
blob-csi-fips-1.24< 1.24.11-r5
blob-csi-fips-1.24-compat< 1.24.11-r5
blob-csi-fips-1.25< 1.25.10-r1
blob-csi-fips-1.25-compat< 1.25.10-r1
blob-csi-fips-1.26< 1.26.7-r3
blob-csi-fips-1.26-compat< 1.26.7-r3
blobfuse2-fips< 2.4.2-r6
blobfuse2-fips-health-monitor< 2.4.2-r6
blobfuse2-fips-syslog< 2.4.2-r6
bom< 0.7.1-r1
boring-registry< 0.16.6-r2
boring-registry-fips< 0.16.6-r2
cadvisor< 0.53.0-r6
cadvisor-compat< 0.53.0-r6
calico-3.29< 3.29.6-r1
calico-apiserver-3.29< 3.29.6-r1
calico-apiserver-compat-3.29< 3.29.6-r1
calico-app-policy-3.29< 3.29.6-r1
calico-cni-3.29< 3.29.6-r1
calico-cni-compat-3.29< 3.29.6-r1
calico-felix-3.29< 3.29.6-r1
calico-key-cert-provisioner-3.29< 3.29.6-r1
calico-kube-controllers-3.29< 3.29.6-r1
calico-node-3.29< 3.29.6-r1
calico-pod2daemon-3.29< 3.29.6-r1
calico-pod2daemon-flexvol-compat-3.29< 3.29.6-r1
calico-typha-client-3.29< 3.29.6-r1
calico-typhad-3.29< 3.29.6-r1
calicoctl-3.29< 3.29.6-r1
capslock< 0.2.8-r1
cargobump< 0.1.0-r7
cephcsi-fips< 3.15.0-r3
cert-exporter< 2.16.0-r2
cert-exporter-fips< 2.16.0-r3
cert-manager-cmctl< 2.3.0-r5
cert-manager-webhook-pdns< 2.5.3-r1
cert-manager-webhook-pdns-fips< 2.5.3-r2
certificate-transparency< 1.3.2-r4
certificate-transparency-trillian-ctserver< 1.3.2-r4
cfssl< 1.6.5-r23
cfssl-bundle< 1.6.5-r23
cfssl-bundle-fips< 1.6.5-r16
cfssl-certinfo< 1.6.5-r23
cfssl-certinfo-fips< 1.6.5-r16
cfssl-fips< 1.6.5-r16
cfssl-json< 1.6.5-r23
cfssl-json-fips< 1.6.5-r16
cfssl-mkbundle< 1.6.5-r23
cfssl-mkbundle-fips< 1.6.5-r16
cfssl-multirootca< 1.6.5-r23
cfssl-multirootca-fips< 1.6.5-r16
cfssl-newkey< 1.6.5-r23
cfssl-newkey-fips< 1.6.5-r16
cfssl-scan< 1.6.5-r23
cfssl-scan-fips< 1.6.5-r16
chartmuseum< 0.16.3-r8
chartmuseum-fips< 0.16.3-r6
checksec< 3.0.2-r6
chisel< 1.11.3-r1
chisel-compat< 1.11.3-r1
chisel-fips< 1.11.3-r1
cilium-1.15< 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.19-r3
cilium-1.15-container-init< 1.15.19-r3
cilium-1.15-container-init-compat< 1.15.19-r3
cilium-1.15-hubble-relay< 1.15.19-r3
cilium-1.15-iptables< 1.15.19-r3
cilium-1.15-operator-aws< 1.15.19-r3
cilium-1.15-operator-generic< 1.15.19-r3
cilium-certgen-0.2< 0.2.4-r3
cilium-envoy-fips-1.15< 1.15.19-r6
cilium-fips-1.15< 1.15.19-r7
cilium-fips-1.15-clustermesh-apiserver< 1.15.19-r7
cilium-fips-1.15-container-init< 1.15.19-r7
cilium-fips-1.15-container-init-compat< 1.15.19-r7
cilium-fips-1.15-host-utils< 1.15.19-r7
cilium-fips-1.15-hubble-relay< 1.15.19-r7
cilium-fips-1.15-operator-aws< 1.15.19-r7
cilium-fips-1.15-operator-azure< 1.15.19-r7
cilium-fips-1.15-operator-generic< 1.15.19-r7
cis-operator-1.2< 1.2.7-r5
cloud-provider-aws-1.28< 1.28.11-r40
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r40
cloud-provider-aws-1.28-ecr-credential-provider< 1.28.11-r40
cloud-provider-aws-1.29< 1.29.8-r40
cloud-provider-aws-1.29-cloud-controller-manager< 1.29.8-r40
cloud-provider-aws-1.29-ecr-credential-provider< 1.29.8-r40
cloud-provider-aws-fips-1.28< 1.28.11-r11
cloud-provider-aws-fips-1.28-cloud-controller-manager< 1.28.11-r11
cloud-provider-aws-fips-1.28-ecr-credential-provider< 1.28.11-r11
cloud-provider-aws-fips-1.29< 1.29.8-r11
cloud-provider-aws-fips-1.29-cloud-controller-manager< 1.29.8-r11
cloud-provider-aws-fips-1.29-ecr-credential-provider< 1.29.8-r11
cloud-provider-azure-1.27< 1.27.21-r15
cloud-provider-azure-1.28< 1.28.14-r11
cloud-provider-azure-1.29< 1.29.15-r5
cloud-provider-azure-1.30< 1.30.15-r1
cloud-provider-azure-1.31< 1.31.9-r1
cloud-provider-azure-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.27< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.27-compat< 1.27.21-r15
cloud-provider-azure-cloud-controller-manager-1.28< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.28-compat< 1.28.14-r11
cloud-provider-azure-cloud-controller-manager-1.29< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.29-compat< 1.29.15-r5
cloud-provider-azure-cloud-controller-manager-1.30< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.30-compat< 1.30.15-r1
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.31-compat< 1.31.9-r1
cloud-provider-azure-cloud-controller-manager-1.33< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-1.33-compat< 1.33.3-r1
cloud-provider-azure-cloud-controller-manager-fips-1.27< 1.27.21-r14

Show all 199

Alpine1 product

go< 1.24.8-r0 | < 1.25.2-r0

2 vendors · 200 products · Showing 200 of 2433

References

114 links

go.dev/cl/709861ARTICLEFIX
go.dev/issue/75677ARTICLEREPORT
groups.google.com/g/golang-announce/c/4Emdl2iQ_bIARTICLEWEB
pkg.go.dev/vuln/GO-2025-4014Advisory
www.openwall.com/lists/oss-security/2025/10/08/1
access.redhat.com/errata/RHSA-2025:21778Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2407258REPORT
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21778.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-58183REPORT

Show all 100 references

Showing 100 of 114.