BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-11-04

Assigner: Go Project

Description

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-29

Last Modified

2025-11-04

Generated

2026-07-06

AI Q&A

2025-10-30

EPSS Evaluated

2026-07-05

NVD

CVE-2025-58183

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	From 1.25.0 (inc) to 1.25.2 (inc)
golang	archive	tar

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

The vulnerability in tar.Reader involves not setting a maximum limit on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. This means that a specially crafted archive with many sparse regions can cause the Reader to load an unbounded amount of data into memory, potentially leading to excessive memory usage. When the archive is compressed, even a small compressed file can cause very large memory allocations during decompression.

Impact Analysis

This vulnerability can impact you by causing your system or application to consume excessive memory when processing maliciously crafted tar archives. This can lead to performance degradation, crashes, or denial of service due to resource exhaustion.

Hi! I’m here to help you understand CVE-2025-58183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70