CVE-2025-58183 Unbounded allocation when parsing GNU sparse map in archive/tar
A maliciously crafted tar archive can cause unbounded memory allocation, leading to denial of service in applications using the Go archive/tar package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-58183?
CVE-2025-58183 is a medium-severity denial of service vulnerability in Go standard library archive/tar, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Which versions are affected by CVE-2025-58183?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.24.8, 1.25.2 |
stdlib Go | All versions | 1.24.8, 1.25.2 |
Linux distribution packages (38)
golang-docs AlmaLinux:10 | All versions | 1.25.3-1.el10_1.alma.1 |
golang-misc AlmaLinux:10 | All versions | 1.25.3-1.el10_1.alma.1 |
golang-src AlmaLinux:10 | All versions | 1.25.3-1.el10_1.alma.1 |
golang-tests AlmaLinux:10 | All versions | 1.25.3-1.el10_1.alma.1 |
grafana AlmaLinux:10 | All versions | 10.2.6-21.el10_1 |
grafana-selinux AlmaLinux:10 | All versions | 10.2.6-21.el10_1 |
image-builder AlmaLinux:10 | All versions | 31-3.el10_1 |
osbuild-composer AlmaLinux:10 | All versions | 149-4.el10_1.alma.3 |
osbuild-composer-core AlmaLinux:10 | All versions | 149-4.el10_1.alma.3 |
osbuild-composer-worker AlmaLinux:10 | All versions | 149-4.el10_1.alma.3 |
podman-docker AlmaLinux:10 | All versions | 7:5.6.0-8.el10_1 |
skopeo AlmaLinux:10 | All versions | 2:1.20.0-2.el10_1 |
skopeo-tests AlmaLinux:10 | All versions | 2:1.20.0-2.el10_1 |
grafana AlmaLinux:8 | All versions | 9.2.10-26.el8_10 |
grafana-selinux AlmaLinux:8 | All versions | 9.2.10-26.el8_10 |
osbuild-composer AlmaLinux:8 | All versions | 101.4-2.el8_10.alma.1 |
osbuild-composer-core AlmaLinux:8 | All versions | 101.4-2.el8_10.alma.1 |
osbuild-composer-worker AlmaLinux:8 | All versions | 101.4-2.el8_10.alma.1 |
delve AlmaLinux:9 | All versions | 1.25.2-1.el9_7 |
go-toolset AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang-bin AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang-docs AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang-misc AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang-race AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang-src AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
golang-tests AlmaLinux:9 | All versions | 1.25.3-1.el9_7 |
grafana AlmaLinux:9 | All versions | 10.2.6-17.el9_7 |
grafana-selinux AlmaLinux:9 | All versions | 10.2.6-17.el9_7 |
image-builder AlmaLinux:9 | All versions | 31-2.el9_7 |
osbuild-composer AlmaLinux:9 | All versions | 149-3.el9_7.alma.3 |
osbuild-composer-core AlmaLinux:9 | All versions | 149-3.el9_7.alma.3 |
osbuild-composer-worker AlmaLinux:9 | All versions | 149-3.el9_7.alma.3 |
podman AlmaLinux:9 | All versions | 6:5.6.0-9.el9_7 |
podman-docker AlmaLinux:9 | All versions | 6:5.6.0-9.el9_7 |
podman-plugins AlmaLinux:9 | All versions | 6:5.6.0-9.el9_7 |
podman-remote AlmaLinux:9 | All versions | 6:5.6.0-9.el9_7 |
podman-tests AlmaLinux:9 | All versions | 6:5.6.0-9.el9_7 |
How do I fix CVE-2025-58183?
Upgrade golang to a fixed version for your release line: 1.24.8 or 1.25.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-58183 being exploited?
There is no known exploitation of CVE-2025-58183 in the wild and no public exploit code.
Sources
Also known as ALSA-2025:21815, ALSA-2025:21816, ALSA-2025:23087, ALSA-2025:23088, ALSA-2025:23294, ALSA-2025:23295 and 378 more.