Vulnerability · Published Oct 29, 2025 · Assigned by Go

CVE-2025-58183Unbounded allocation when parsing GNU sparse map in archive/tar

Medium 4.3

In plain English

A medium-severity security flaw in archive/tar from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10buildah2:1.41.6-1.el10_1ALSA-2025:22012
AlmaLinux:9buildah2:1.41.6-1.el9_7ALSA-2025:22011
AlmaLinux:10buildah-tests2:1.41.6-1.el10_1ALSA-2025:22012
AlmaLinux:9buildah-tests2:1.41.6-1.el9_7ALSA-2025:22011
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9delve1.25.2-1.el9_7ALSA-2025:21815
AlmaLinux:8go-toolset1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9go-toolset1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:8golang1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:8golang-bin1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang-bin1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:10golang-docs1.25.3-1.el10_1.alma.1ALSA-2025:21816
AlmaLinux:8golang-docs1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang-docs1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:10golang-misc1.25.3-1.el10_1.alma.1ALSA-2025:21816
AlmaLinux:8golang-misc1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang-misc1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:8golang-race1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang-race1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:10golang-src1.25.3-1.el10_1.alma.1ALSA-2025:21816
AlmaLinux:8golang-src1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang-src1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:10golang-tests1.25.3-1.el10_1.alma.1ALSA-2025:21816
AlmaLinux:8golang-tests1.25.3-2.module_el8.10.0+4074+24330916ALSA-2025:22668
AlmaLinux:9golang-tests1.25.3-1.el9_7ALSA-2025:21815
AlmaLinux:10grafana10.2.6-21.el10_1ALSA-2025:23088
AlmaLinux:8grafana9.2.10-26.el8_10ALSA-2025:23948
AlmaLinux:9grafana10.2.6-17.el9_7ALSA-2025:23087
AlmaLinux:10grafana-selinux10.2.6-21.el10_1ALSA-2025:23088
AlmaLinux:8grafana-selinux9.2.10-26.el8_10ALSA-2025:23948
AlmaLinux:9grafana-selinux10.2.6-17.el9_7ALSA-2025:23087
AlmaLinux:10image-builder31-3.el10_1ALSA-2026:1838
AlmaLinux:9image-builder31-2.el9_7ALSA-2026:1377
AlmaLinux:10osbuild-composer149-4.el10_1.alma.3ALSA-2026:1837
AlmaLinux:8osbuild-composer101.4-2.el8_10.alma.1ALSA-2026:1380
AlmaLinux:9osbuild-composer149-3.el9_7.alma.3ALSA-2026:1381
AlmaLinux:10osbuild-composer-core149-4.el10_1.alma.3ALSA-2026:1837
AlmaLinux:8osbuild-composer-core101.4-2.el8_10.alma.1ALSA-2026:1380
AlmaLinux:9osbuild-composer-core149-3.el9_7.alma.3ALSA-2026:1381
AlmaLinux:10osbuild-composer-worker149-4.el10_1.alma.3ALSA-2026:1837
AlmaLinux:8osbuild-composer-worker101.4-2.el8_10.alma.1ALSA-2026:1380
AlmaLinux:9osbuild-composer-worker149-3.el9_7.alma.3ALSA-2026:1381
AlmaLinux:9podman6:5.6.0-9.el9_7ALSA-2025:23325
AlmaLinux:10podman-docker7:5.6.0-8.el10_1ALSA-2025:23295
AlmaLinux:9podman-docker6:5.6.0-9.el9_7ALSA-2025:23325
AlmaLinux:9podman-plugins6:5.6.0-9.el9_7ALSA-2025:23325
AlmaLinux:9podman-remote6:5.6.0-9.el9_7ALSA-2025:23325
AlmaLinux:9podman-tests6:5.6.0-9.el9_7ALSA-2025:23325
AlmaLinux:10skopeo2:1.20.0-2.el10_1ALSA-2025:23294
AlmaLinux:9skopeo2:1.20.0-2.el9_7ALSA-2025:23326
AlmaLinux:10skopeo-tests2:1.20.0-2.el10_1ALSA-2025:23294
AlmaLinux:9skopeo-tests2:1.20.0-2.el9_7ALSA-2025:23326
Alpine:v3.22go1.24.8-r0ALPINE-CVE-2025-58183
Alpine:v3.23go1.25.2-r0ALPINE-CVE-2025-58183
Alpine:v3.24go1.25.2-r0ALPINE-CVE-2025-58183
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-58183
Debian:13golang-1.24no fix listedDEBIAN-CVE-2025-58183
Gostdlib1.24.8, 1.25.2GO-2025-4014
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:10buildah2:1.41.6-1.el10_1RLSA-2025:22012
Rocky Linux:9buildah2:1.41.6-1.el9_7RLSA-2025:22011
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8containernetworking-plugins1:1.4.0-6.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8containernetworking-plugins1:1.4.0-6.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8crun0:1.14.3-2.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:10delve0:1.25.2-1.el10_1RLSA-2025:21816
Rocky Linux:8delve0:1.25.2-1.module+el8.10.0+40035+ee0a7047RLSA-2025:22668
Rocky Linux:9delve0:1.25.2-1.el9_7RLSA-2025:21815
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8fuse-overlayfs0:1.13-1.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:10golang0:1.25.3-1.el10_1RLSA-2025:21816
Rocky Linux:8golang0:1.25.3-2.module+el8.10.0+40037+cec252d2RLSA-2025:22668
Rocky Linux:9golang0:1.25.3-1.el9_7RLSA-2025:21815
Rocky Linux:10grafana0:10.2.6-21.el10_1RLSA-2025:23088
Rocky Linux:8grafana0:9.2.10-26.el8_10RLSA-2025:23948
Rocky Linux:9grafana0:10.2.6-17.el9_7RLSA-2025:23087
Rocky Linux:10image-builder0:31-3.el10_1.rocky.0.2RLSA-2026:1838
Rocky Linux:9image-builder0:31-2.el9_7.rocky.0.2RLSA-2026:1377
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8libslirp0:4.4.0-2.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8netavark2:1.10.3-1.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8oci-seccomp-bpf-hook0:1.2.10-1.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:10osbuild-composer0:149-4.el10_1.rocky.0.8RLSA-2026:1837
Rocky Linux:8osbuild-composer0:101.4-2.el8_10.rocky.0.6RLSA-2026:1380
Rocky Linux:9osbuild-composer0:149-3.el9_7.rocky.0.8RLSA-2026:1381
Rocky Linux:10podman7:5.6.0-8.el10_1RLSA-2025:23295
Rocky Linux:9podman6:5.6.0-9.el9_7RLSA-2025:23325
Rocky Linux:8python-podman0:4.9.0-3.module+el8.10.0+1896+b18fa106RLSA-2025:23374
Rocky Linux:8python-podman0:4.9.0-3.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8python-podman0:4.9.0-3.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8python-podman0:4.9.0-3.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8runc4:1.2.9-2.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:10skopeo2:1.20.0-2.el10_1RLSA-2025:23294
Rocky Linux:8skopeo2:1.14.5-5.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:9skopeo2:1.20.0-2.el9_7RLSA-2025:23326
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+2001+6a33db9fRLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1825+623b0c20RLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1815+5fe7415eRLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1874+ce489889RLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1880+8e896d1bRLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1872+2e18eb19RLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+40047+0c0a73f4RLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1843+6892ab28RLSA-2025:23374
Rocky Linux:8slirp4netns0:1.2.3-1.module+el8.10.0+1896+b18fa106RLSA-2025:23374

Affected products (as reported)

VendorProductVersions
Go standard library archive/tar 0 – before 1.24.81.25.0 – before 1.25.2

References