CVE-2025-58183
Unbounded allocation when parsing GNU sparse map in archive/tar
Reported by go · Published October 29, 2025
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| sealed-secrets | Chainguard | 0.32.2-r2 |
| http-echo | Wolfi | 1.0.0-r18 |
| crane | Chainguard | 0.20.6-r3 |
| cloudbeat-fips-8.18 | Chainguard | 8.18.8-r1 |
| chartmuseum | Wolfi | 0.16.3-r8 |
| gcp-compute-persistent-disk-csi-driver-1.15 | Chainguard | 1.15.4-r55 |
| helm-set-status | Wolfi | 0.3.0-r5 |
| conjur-cli | Chainguard | 8.1.3-r1 |
| kubelet-csr-approver | Chainguard | 1.2.11-r1 |
| kubernetes-event-exporter-fips | Chainguard | 1.7-r14 |
| whereabouts | Chainguard | 0.9.2-r2 |
| external-dns-0.16 | Chainguard | 0.16.1-r4 |
87 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | archive/tar | 0, 1.25.0 |
| chainguard | sealed-secrets | 0 |
| wolfi | http-echo | 0 |
| chainguard | crane | 0 |
| chainguard | cloudbeat-fips-8.18 | 0 |
| wolfi | chartmuseum | 0 |
| chainguard | gcp-compute-persistent-disk-csi-driver-1.15 | 0 |
| wolfi | helm-set-status | 0 |
| chainguard | conjur-cli | 0 |
| chainguard | kubelet-csr-approver | 0 |
| chainguard | kubernetes-event-exporter-fips | 0 |
| chainguard | whereabouts | 0 |
| chainguard | external-dns-0.16 | 0 |
| wolfi | kubescape-operator | 0 |
| wolfi | gcp-compute-persistent-disk-csi-driver-1.16 | 0 |
| wolfi | docker-credential-gcr | 0 |
| chainguard | kuberlr | 0 |
| wolfi | spire-controller-manager | 0 |
| chainguard | extism | 0 |
| chainguard | cloud-provider-aws-1.29 | 0 |
…and 1254 more
Timeline
- Oct 7, 2025 CVE Published
- Oct 30, 2025 EPSS Score (30 in total, the first dated here)
- Mar 20, 2026 Distribution Patch (136 in total, the first dated here)
- Mar 20, 2026 Security Advisory (182 in total, the first dated here)
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
- Apr 18, 2026 PoC Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-58183
vulnetix vdb fixes CVE-2025-58183Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-58183/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart