CVE-2025-58183: tar.Reader DOS Vulnerability

CVE-2025-58183 Overview

CVE-2025-58183 affects the Go standard library archive/tar package. The tar.Reader does not enforce a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously crafted archive containing many sparse regions can cause the Reader to allocate an unbounded amount of memory while parsing the archive. When the archive originates from a compressed source, a small compressed payload can expand into very large memory allocations during parsing.

Critical Impact
Attackers can trigger memory exhaustion in Go applications that consume untrusted tar archives, leading to denial of service.

Affected Products

Go standard library archive/tar package
Applications and services parsing tar archives via Go's tar.Reader
Go tooling and pipelines processing GNU tar pax 1.0 sparse files from untrusted sources

Discovery Timeline

2025-10-29 - CVE-2025-58183 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-58183

Vulnerability Analysis

The flaw is a resource exhaustion issue in the parser for GNU tar pax 1.0 sparse file headers. Sparse files in tar describe regions of data and holes using a count of sparse regions followed by offset/length pairs. The tar.Reader reads this region count from attacker-controlled archive metadata and uses it to drive subsequent allocations. The implementation does not validate the count against the actual archive size or any upper bound.

An attacker can declare an extremely large number of sparse regions in a crafted header. The Reader then attempts to read and store data for each region, consuming memory proportional to the declared count. The asymmetry becomes severe when the archive is delivered through a compressor such as gzip or zstd, where a few kilobytes of compressed input expand into multi-gigabyte allocations.

Root Cause

The root cause is missing input validation on the sparse region count parsed from pax 1.0 sparse file metadata. The parser trusts the count without bounding it against archive length or a configurable limit. This is a classic algorithmic resource consumption defect rather than a memory safety bug.

Attack Vector

Exploitation requires the target application to read a tar archive supplied by an attacker. The attack vector is network-reachable when applications accept tar uploads, fetch tar artifacts, or parse container image layers. User interaction is required to initiate parsing of the malicious archive. The result is process memory exhaustion and denial of service for the host or container.

No verified public proof-of-concept code is available. Technical details are described in the Go vulnerability database entry GO-2025-4014 and the Go issue tracker entry.

Detection Methods for CVE-2025-58183

Indicators of Compromise

Go processes terminating with out-of-memory errors shortly after receiving or fetching a tar archive
Sudden spikes in resident memory in services that ingest .tar, .tar.gz, or OCI image layers
Repeated crashes of container runtimes, CI/CD agents, or backup tools parsing externally supplied tar files

Detection Strategies

Inventory Go binaries and services using go version -m to identify builds linked against vulnerable archive/tar versions
Inspect tar archives from untrusted sources for GNU pax 1.0 sparse headers (GNU.sparse.major=1, GNU.sparse.minor=0) with unusually large GNU.sparse.numblocks values
Correlate OOM kill events from kernel logs with preceding tar parsing activity in application logs

Monitoring Recommendations

Alert on container or process memory growth exceeding baselines during archive extraction workloads
Log and review the size ratio between compressed inputs and decompressed outputs in archive-handling services
Track Go module dependency updates through software composition analysis to flag projects still on vulnerable Go toolchains

How to Mitigate CVE-2025-58183

Immediate Actions Required

Upgrade to a patched Go toolchain release that includes the fix referenced in Go change list 709861 and rebuild affected binaries
Update third-party Go dependencies that vendor archive/tar or wrap it with custom readers
Restrict archive parsing services to authenticated sources where feasible and enforce strict size limits on uploads

Patch Information

The fix is tracked in Go change list 709861 and announced via the golang-announce mailing list. Rebuild and redeploy all Go applications using a patched toolchain. Additional context is available in the Openwall oss-security thread.

Workarounds

Run archive parsing in sandboxed processes with strict memory cgroup limits to contain exhaustion attempts
Reject tar entries containing GNU pax 1.0 sparse headers when sparse file support is not required by the application
Cap input archive sizes and decompressed output sizes before invoking tar.Reader

bash

# Configuration example: enforce a memory limit on a Go service parsing tar archives
systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 \
    /usr/local/bin/my-go-archive-service