CVE-2025-58183 is a denial of service vulnerability in the Go archive/tar package where the tar.Reader does not limit the number of sparse region data blocks in GNU tar pax 1.0 sparse files. An attacker can craft a tar archive with a large number of sparse regions, causing a Go application to allocate excessive memory, leading to out-of-memory conditions and service disruption. This vulnerability affects Red Hat OpenShift Container Platform versions >=4.18.0 <4.18.42 and multicluster engine for Kubernetes versions >=2.10.0 <2.10.4. Red Hat has acknowledged the issue and provided updated packages in OpenShift Container Platform 4.18.42 and multicluster engine 2.10.4 to mitigate the risk. No known exploits in the wild have been reported. The vulnerability is rated with moderate to high severity due to its impact on availability.

The vulnerability allows an attacker to cause a denial of service by exhausting memory resources when a vulnerable Go application processes a specially crafted GNU tar pax 1.0 sparse archive. This results in high availability impact but does not affect confidentiality or integrity. No other security impacts have been reported. Exploitation requires the ability to supply or process malicious tar archives in the affected environment.

Red Hat has released updated packages for OpenShift Container Platform 4.18.42 and multicluster engine for Kubernetes 2.10.4 that address this vulnerability. Users should upgrade to these fixed versions to remediate the issue. No alternative mitigations are currently available or meet Red Hat's criteria for ease of use and deployment. Monitoring for updates and applying vendor patches promptly is recommended.