CVE-2025-58183
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-29

Last updated on: 2025-11-04

Assigner: Go Project

Description
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-29
Last Modified
2025-11-04
Generated
2026-06-16
AI Q&A
2025-10-30
EPSS Evaluated
2026-06-15
NVD
CVE-2025-58183
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
golang go From 1.25.0 (inc) to 1.25.2 (inc)
golang archive tar
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in tar.Reader involves not setting a maximum limit on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. This means that a specially crafted archive with many sparse regions can cause the Reader to load an unbounded amount of data into memory, potentially leading to excessive memory usage. When the archive is compressed, even a small compressed file can cause very large memory allocations during decompression.

Impact Analysis

This vulnerability can impact you by causing your system or application to consume excessive memory when processing maliciously crafted tar archives. This can lead to performance degradation, crashes, or denial of service due to resource exhaustion.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-58183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart