Unbounded allocation when parsing GNU sparse map in archive/tar

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-58183 · Microsoft / collected KEV context

EUVD-2025-36731

GHSA-9gcr-gp5f-jw27

GO-2025-4014

BIT-golang-2025-58183

cve-program · CVE-2025-58183

• https://go.dev/cl/709861
• https://go.dev/issue/75677
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• https://pkg.go.dev/vuln/GO-2025-4014

euvd · EUVD-2025-36731

• https://go.dev/cl/709861
• https://go.dev/issue/75677
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• https://pkg.go.dev/vuln/GO-2025-4014

nvd · CVE-2025-58183

• https://go.dev/cl/709861
• https://go.dev/issue/75677
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
• https://pkg.go.dev/vuln/GO-2025-4014
• http://www.openwall.com/lists/oss-security/2025/10/08/1

osv · GO-2025-4014

• https://go.dev/cl/709861
• https://go.dev/issue/75677
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

• Release Notes - 2026-03-05 · Tool release · 11 Mar 2026
• Release 2026-02-08 · Tool release · 17 Feb 2026
• Release 2026-01-04 · Tool release · 9 Jan 2026