Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
BREAKING: Fedora ships Incus 6.23 security update for Fedora 42 and 43, fixing CVE-2025-58183, CVE-2026-23954, CVE-2025-69725 and CVE-2026-23953 in the container hypervisor. https://threatcluster.io/cluster/fedora-incus-623-security-update-addresses-multiple-vulnerab-faf3dc82
Post summary
Fedora has released a security update (Incus 6.23) that addresses multiple CVEs, including CVE-2025-58183 and several others.