CVE-2025-58183

Public on 2025-10-13
Modified on 2025-11-03
Description
archive/tar: unbounded allocation when parsing GNU sparse map

tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input could result in large allocations.
Severity
Low severity
Low
See what this means
CVSS v3 Base Score
3.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core amazon-cloudwatch-agent Pending Fix
Amazon Linux 2023 amazon-cloudwatch-agent Pending Fix
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra amazon-ecr-credential-helper Pending Fix
Amazon Linux 2 - Ecs Extra amazon-ecr-credential-helper Pending Fix
Amazon Linux 2023 amazon-ecr-credential-helper Pending Fix
Amazon Linux 2 - Core amazon-ssm-agent Pending Fix
Amazon Linux 2023 amazon-ssm-agent Pending Fix
Amazon Linux 2 - Core cni-plugins Pending Fix
Amazon Linux 2023 cni-plugins Pending Fix
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra containerd Pending Fix
Amazon Linux 2 - Docker Extra containerd Pending Fix
Amazon Linux 2 - Ecs Extra containerd Pending Fix
Amazon Linux 2023 containerd Pending Fix
Amazon Linux 2 - Core cri-tools Pending Fix
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra docker Pending Fix
Amazon Linux 2 - Docker Extra docker Pending Fix
Amazon Linux 2 - Ecs Extra docker Pending Fix
Amazon Linux 2023 docker Pending Fix
Amazon Linux 2 - Ecs Extra ecs-init Pending Fix
Amazon Linux 2023 ecs-init Pending Fix
Amazon Linux 2 - Core golang 2025-10-27 ALAS2-2025-3042 Fixed
Amazon Linux 2023 golang 2025-10-27 ALAS2023-2025-1239 Fixed
Amazon Linux 2 - Core golang-github-cpuguy83-go-md2man Not Affected
Amazon Linux 2 - Core golang-github-godbus-dbus Not Affected
Amazon Linux 2 - Core golang-github-gorilla-context Not Affected
Amazon Linux 2 - Core golang-github-kr-pty Not Affected
Amazon Linux 2 - Core golang-github-syndtr-gocapability Not Affected
Amazon Linux 2 - Core golist Pending Fix
Amazon Linux 2023 golist Pending Fix
Amazon Linux 2023 libcap Pending Fix
Amazon Linux 2 - Core nerdctl Pending Fix
Amazon Linux 2023 nerdctl Pending Fix
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra oci-add-hooks Pending Fix
Amazon Linux 2 - Docker Extra oci-add-hooks Pending Fix
Amazon Linux 2 - Ecs Extra oci-add-hooks Pending Fix
Amazon Linux 2023 oci-add-hooks Pending Fix
Amazon Linux 2 - Core rclone Pending Fix
Amazon Linux 2 - Aws-nitro-enclaves-cli Extra runc Pending Fix
Amazon Linux 2 - Docker Extra runc Pending Fix
Amazon Linux 2 - Ecs Extra runc Pending Fix
Amazon Linux 2023 runc Pending Fix
Amazon Linux 2 - Docker Extra runfinch-finch Pending Fix
Amazon Linux 2023 runfinch-finch Pending Fix
Amazon Linux 2 - Docker Extra soci-snapshotter Pending Fix
Amazon Linux 2023 soci-snapshotter Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
NVD CVSSv3 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L