CVE-2025-62518

    Dashboard / Vulnerabilities / CVE-2025-62518

    CVE-2025-62518

    Published: 21 Oct 2025Last Modified: 10 Oct 2026

    Summary: astral-tokio-tar Vulnerable to PAX Header Desynchronization

    Details: astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

    References: https://edera.dev/stories/tarmageddon, https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62518.json, https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx, https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9, https://nvd.nist.gov/vuln/detail/CVE-2025-62518, https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318, https://github.com/edera-dev/cve-tarmageddon

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -22b3f884adb7a2adf1d3a8d03469533f5cbc8318

    Affected versions

    v0.5.5
    v0.5.4
    v0.5.3
    v0.5.2
    v0.5.1
    v0.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62518 | CVE-DB