CVE-2025-58183 Details
Description
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
A vulnerability exists in the Go programming language's standard library, specifically in the archive/tar package, prior to version 1.24.8 and between versions 1.25.0 and 1.25.2. The issue arises because the tar.Reader component does not impose a limit on the number of sparse region data blocks when processing GNU tar pax 1.0 sparse files. This lack of restriction can lead to unbounded memory allocation, as a maliciously crafted archive with numerous sparse regions can cause the Reader to consume excessive amounts of data from the archive. The problem is exacerbated when the archive is compressed, as a small compressed input can result in significantly larger memory allocations.
Users can upgrade to Go versions 1.25.2 or 1.24.8, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2025CISA-ADP
Assessed Oct 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/10/08/1 | CVE | |
| https://go.dev/cl/709861 | [email protected] | Source CodeVendor |
| https://go.dev/issue/75677 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI | [email protected] | AdvisoryBundleMailing ListRemedyVendor |
| https://pkg.go.dev/vuln/GO-2025-4014 | [email protected] | AdvisoryVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| golang archive/tar | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CISA-ADP |
| Oct 30, 2025 | CVE Modified | CISA-ADP |
| Oct 29, 2025 | New CVE Received | [email protected] |