CVE-2025-58183 is a vulnerability in the Go standard library's archive/tar package used by Red Hat OpenShift Service Mesh prior to version 3.1.5. The tar.Reader does not limit the number of sparse region data blocks in GNU tar pax 1.0 sparse files. An attacker supplying a specially crafted tar archive with a large number of sparse regions can cause the Go application to allocate excessive memory, resulting in an out-of-memory condition and denial of service. This vulnerability is rated with moderate severity by Red Hat but is classified as high severity in this advisory due to its impact on availability. Red Hat OpenShift Service Mesh 3.1.5 includes a fix by updating to Istio 1.26.8, which addresses this and related resource consumption issues. Exploitation requires the ability to process malicious tar archives within the affected software components.

Successful exploitation of this vulnerability can cause the affected Go application within Red Hat OpenShift Service Mesh to consume excessive memory, leading to an out-of-memory condition and denial of service. There is no impact on confidentiality or integrity. No known exploits are currently reported in the wild. The denial of service could disrupt microservice communication managed by the service mesh, potentially affecting application availability.

A fix is available in Red Hat OpenShift Service Mesh version 3.1.5, which updates Istio to version 1.26.8 and addresses this vulnerability. Users should upgrade to version 3.1.5 or later to remediate this issue. No alternative mitigations are currently available or recommended by Red Hat. Refer to the official Red Hat advisory RHSA-2026:3108 for detailed upgrade instructions.