CVE-2025-58183: Unbounded Allocation Vulnerability in Go's Archive/Tar Package
Summary
CVE-2025-58183: Unbounded allocation when parsing GNU sparse map in archive/tar. Affects stdlib across 2 version ranges.
< 1.24.8
>= 1.25.0, < 1.25.2
Fixed in 1.24.8 or 1.25.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2025-58183 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language's standard library includes the archive/tar package, which provides functionality for reading and writing tar archives. This package is widely used for handling tar files, including those that utilize the GNU sparse format. The package's ability to manage sparse files is essential for efficient storage, but it also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerability arises from the tar.Reader's failure to impose a maximum limit on the number of sparse region data blocks when parsing GNU tar pax 1.0 sparse files. An attacker can exploit this by crafting a malicious archive that contains an excessive number of sparse regions, leading the Reader to read an unbounded amount of data into memory. This can result in significant memory allocation, potentially causing denial of service or application crashes, especially when dealing with compressed sources where small inputs can decompress into large allocations.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.24.81.24.8go get stdlib@v1.24.8 -
>= 1.25.0, < 1.25.21.25.2go get stdlib@v1.25.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted or unverified tar archives, especially those that may contain sparse regions. Additionally, consider implementing checks on the size of the data being read to prevent excessive memory usage.
Conclusion
CVE-2025-58183 highlights a significant vulnerability in the Go standard library's archive/tar package, which can lead to unbounded memory allocation. It is crucial for developers to update their Go installations to the latest patched versions and to exercise caution when handling tar archives.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-58183 is a vulnerability in the Go standard library's archive/tar package that allows for unbounded memory allocation when parsing certain types of tar files.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Gopkg.lock file without needing to sign up.
The primary risk is denial of service due to excessive memory allocation, which can lead to application crashes or degraded performance.
You can update your Go version by using the command 'go get golang.org/dl/go1.25.2' and then downloading it with 'go1.25.2 download'.
Yes, you can mitigate the risk by avoiding the processing of untrusted tar files and implementing size checks on data being read.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
