Moderate Security Update for Grafana: Addressing CVE-2025-58183
Summary
ALSA-2025:23087: Moderate: grafana security update. Affects grafana versions < 10.2.6-17.el9_7. Fixed in 10.2.6-17.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source analytics and monitoring platform that allows users to visualize and analyze data from various sources such as Graphite, InfluxDB, and OpenTSDB. It is widely used for creating dashboards and graphs to monitor system performance and metrics. The recent vulnerability identified as CVE-2025-58183 pertains to an unbounded allocation issue in the Golang archive/tar package, which can potentially lead to denial-of-service attacks if exploited.
Vulnerability Detail
The vulnerability CVE-2025-58183 is rooted in the Golang archive/tar package, which is utilized by Grafana for handling tar files. The flaw allows for unbounded memory allocation when parsing GNU sparse maps, which can be exploited by an attacker to create specially crafted tar files. If a vulnerable version of Grafana processes such a tar file, it could lead to excessive memory consumption, resulting in denial-of-service conditions that could disrupt the availability of the Grafana service.
How To Fix
Minimum fixed version
10.2.6-17.el9_7
This is the first release that contains the fix.
sudo dnf update grafanaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted tar files until the update is applied. This will help prevent potential exploitation of the vulnerability until a patch is implemented.
Conclusion
The Grafana security update addressing CVE-2025-58183 is crucial for maintaining the integrity and availability of your monitoring services. By updating to the patched version, users can protect their systems from potential denial-of-service attacks stemming from this vulnerability.
See every vulnerability recorded for grafana →
FAQ
CVE-2025-58183 is a security vulnerability in the Golang archive/tar package used by Grafana, which can lead to unbounded memory allocation and potential denial-of-service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, avoid processing untrusted tar files to mitigate the risk of exploitation.
Failing to address this vulnerability could lead to denial-of-service conditions, making your Grafana service unavailable and impacting your monitoring capabilities.
For more details, refer to the CVE page associated with CVE-2025-58183, which provides in-depth information about the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
