Vulnerability GO-2025-4014
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
11 months ago
October 29, 2025 at 09:51 PM UTC
Unbounded allocation when parsing GNU sparse map in archive/tar
<1.24.8
<1.24.8
Summary
Unbounded allocation when parsing GNU sparse map in archive/tar
Details
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Enforce maximum recursion depth in encoding/asn1
<1.25.13 GO-2026-5972
<1.25.13 GO-2026-5972
Unknown
1 month ago
Add recursion depth guard during decode in encoding/xml
<1.25.13 GO-2026-6088
<1.25.13 GO-2026-6088
Unknown
1 month ago
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
<1.25.13 GO-2026-6089
<1.25.13 GO-2026-6089
Unknown
1 month ago
Limit handshake messages we are willing to accept post-handshake in crypto/tls
<1.25.13 GO-2026-6090
<1.25.13 GO-2026-6090
Unknown
1 month ago
Fix Javascript regexp context tracking in html/template
<1.25.13 GO-2026-6091
<1.25.13 GO-2026-6091
Impacted packages
Timeline
Published
11 months ago
October 29, 2025 at 09:51 PM UTC
Last Modified
6 hours ago
October 02, 2026 at 10:41 AM UTC