tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 29 Oct 2025 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations. | |
| Title | Unbounded allocation when parsing GNU sparse map in archive/tar | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2025-10-29T22:10:14.376Z
Reserved: 2025-08-27T14:50:58.691Z
Link: CVE-2025-58183
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-29T23:16:19.357
Modified: 2025-10-29T23:16:19.357
Link: CVE-2025-58183
Redhat
No data.
OpenCVE Enrichment
No data.