CVE-2025-58183: Unbounded allocation when parsing GNU sparse map in archive/tar
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58183?
CVE-2025-58183 has a high severity rating due to its potential to cause significant memory exploitation.
How do I fix CVE-2025-58183?
To mitigate CVE-2025-58183, ensure you are using the latest version of GNU tar that includes the security patch.
What are the potential impacts of CVE-2025-58183?
CVE-2025-58183 can lead to memory exhaustion or denial of service by allowing malicious archives to consume excessive system resources.
Who is affected by CVE-2025-58183?
CVE-2025-58183 affects users of GNU tar, particularly those working with PAX sparse files.
How can I determine if my system is vulnerable to CVE-2025-58183?
You can check your installed version of GNU tar and compare it against known vulnerable versions listed in the vulnerability advisory.