Moderate Security Update for Grafana: Addressing CVE-2025-58183
Summary
ALSA-2025:23948: Moderate: grafana security update. Affects grafana versions < 9.2.10-26.el8_10. Fixed in 9.2.10-26.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source platform designed for monitoring and visualizing metrics from various data sources such as Graphite, InfluxDB, and OpenTSDB. It provides users with a rich set of features for creating dashboards and graphs, making it a popular choice among developers and system administrators. However, like any software, Grafana can be susceptible to vulnerabilities that may compromise its security and functionality.
Vulnerability Detail
The vulnerability identified as CVE-2025-58183 pertains to an unbounded allocation issue when parsing GNU sparse maps in the Go programming language's archive/tar package. This flaw could potentially lead to denial of service attacks or excessive resource consumption, impacting the performance and availability of the Grafana application. It is crucial to address this vulnerability to maintain the integrity and reliability of the software.
How To Fix
Minimum fixed version
9.2.10-26.el8_10
This is the first release that contains the fix.
sudo dnf update grafanaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability other than applying the patch. It is recommended to monitor the application closely until the update can be applied.
Conclusion
In summary, the moderate security update for Grafana addresses a critical vulnerability (CVE-2025-58183) that could lead to denial of service. Users are urged to update their installations to the latest patched version to ensure the security and reliability of their applications. Utilizing tools like Vulert can further enhance your ability to monitor and respond to vulnerabilities in real-time.
See every vulnerability recorded for grafana →
FAQ
CVE-2025-58183 is a security vulnerability in the Go programming language's archive/tar package that affects Grafana, leading to potential denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include potential denial of service attacks and excessive resource consumption, which can degrade the performance and availability of Grafana.
It is recommended to regularly check for updates and apply them promptly to mitigate vulnerabilities and ensure optimal performance.
Yes, Vulert provides real-time monitoring for open-source vulnerabilities using a manifest file like package-lock.json, allowing you to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
