Moderate Vulnerability in Skopeo: Unbounded Allocation in GNU Sparse Map
Summary
ALSA-2025:23294: Moderate: skopeo security update. Affects skopeo versions < 2:1.20.0-2.el10_1. Fixed in 2:1.20.0-2.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Skopeo is a command-line utility that allows users to inspect container images from various registries, retrieve images and image layers, and manage image signatures. It is widely used in containerized environments for its ability to facilitate image management without requiring a local copy of the image. However, a recent vulnerability has been identified that affects its functionality and security.
Vulnerability Detail
The vulnerability arises from an unbounded allocation issue when parsing the GNU sparse map in the golang archive/tar package, identified as CVE-2025-58183. This flaw can lead to excessive memory allocation, potentially resulting in denial of service (DoS) conditions. Attackers could exploit this vulnerability by crafting malicious tar files that, when processed by Skopeo, could consume excessive system resources, leading to application crashes or degraded performance.
How To Fix
Minimum fixed version
2:1.20.0-2.el10_1
This is the first release that contains the fix.
sudo dnf update skopeoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid processing untrusted or unknown tar files with Skopeo until the package is updated to the patched version. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
In summary, the identified vulnerability in Skopeo poses a moderate risk due to unbounded allocation issues in the golang archive/tar package. Users are advised to update their Skopeo installations to the latest patched version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for skopeo →
FAQ
Skopeo is a command-line tool that facilitates the management of container images and image repositories, allowing users to inspect, copy, and sign images without requiring local storage.
CVE-2025-58183 refers to a specific vulnerability in the golang archive/tar package that can lead to unbounded memory allocation when processing GNU sparse maps.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
The vulnerability can lead to denial of service (DoS) conditions, where an attacker could exploit the flaw to consume excessive system resources, causing application crashes or performance degradation.
Yes, as a temporary measure, avoid processing untrusted tar files with Skopeo until the package is updated to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for skopeo.
