CVE-2025-62518
published 2025-10-21CVE-2025-62518: astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability…
PriorityP344high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.68%
48.3th percentile
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alexcrichton | tar-rs | < 0.4.45 | 0.4.45 |
| alexcrichton | tar-rs | < 0.4.45 | 0.4.45 |
| astral-sh | tokio-tar | 0 – 0.3.1 | — |
| astral-sh | tokio-tar | >= 0.0.0-0 | — |
| astral-sh | uv | >= 0 < 0.9.5 | 0.9.5 |
| debian | rust-astral-tokio-tar | < rust-astral-tokio-tar 0.5.6-1 (forky) | rust-astral-tokio-tar 0.5.6-1 (forky) |
| debian | rust-tar | < rust-tar 0.4.45-1 (forky) | rust-tar 0.4.45-1 (forky) |
| debian | rustc | < rust-tar 0.4.45-1 (forky) | rust-tar 0.4.45-1 (forky) |
| gnu | tar | >= 0 < 0.4.45 | 0.4.45 |
| gnu | tar | >= 0.0.0-0 < 0.4.45 | 0.4.45 |
| msrc | azl3_kata-containers-cc_3.15.0.aks0-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_kata-containers-cc_3.15.0.aks0-6_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
ghsa8.1HIGH
osv8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-33055: tar-rs is a tar archive reading/writing library for Rust
osv·2026-03-20·CVSS 8.1
CVE-2026-33055 [HIGH] CVE-2026-33055: tar-rs is a tar archive reading/writing library for Rust
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives a
GHSA
tar-rs incorrectly ignores PAX size headers if header size is nonzero
ghsa·2026-03-20·CVSS 8.1
CVE-2026-33055 [HIGH] CWE-843 tar-rs incorrectly ignores PAX size headers if header size is nonzero
tar-rs incorrectly ignores PAX size headers if header size is nonzero
### Summary
As part of [CVE-2025-62518](https://www.cve.org/CVERecord?id=CVE-2025-62518) the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header.
However, it was missed at the time that this project (the original Rust `tar` crate) had a conditional logic that skipped the PAX size header in the case that the base header size was nonzero - almost the inverse of the astral-tokio-tar issue.
The problem here is that *any* discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers.
In this case, the tar-rs (Rust `tar`) crate is an outlier in checking for the header si
OSV
tar-rs incorrectly ignores PAX size headers if header size is nonzero
osv·2026-03-20·CVSS 8.1
CVE-2026-33055 [HIGH] tar-rs incorrectly ignores PAX size headers if header size is nonzero
tar-rs incorrectly ignores PAX size headers if header size is nonzero
### Summary
As part of [CVE-2025-62518](https://www.cve.org/CVERecord?id=CVE-2025-62518) the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header.
However, it was missed at the time that this project (the original Rust `tar` crate) had a conditional logic that skipped the PAX size header in the case that the base header size was nonzero - almost the inverse of the astral-tokio-tar issue.
The problem here is that *any* discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers.
In this case, the tar-rs (Rust `tar`) crate is an outlier in checking for the header si
OSV
tar-rs incorrectly ignores PAX size headers if header size is nonzero
osv·2026-03-19·CVSS 8.1
CVE-2026-33055 [HIGH] tar-rs incorrectly ignores PAX size headers if header size is nonzero
tar-rs incorrectly ignores PAX size headers if header size is nonzero
Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX
size header in cases where the base header size is nonzero.
As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar]
project was changed to correctly honor PAX size headers in the case where it
was different from the base header. This is almost the inverse of the
astral-tokio-tar issue.
Any discrepancy in how tar parsers honor file size can be used to create
archives that appear differently when unpacked by different archivers. In this
case, the tar-rs (Rust tar) crate is an outlier in checking for the header size
— other tar parsers (including e.g. Go [`archive/tar`][go-tar]) unconditionally
use the PAX size override. This can affect
OSV
uv has differential in tar extraction with PAX headers
osv·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] uv has differential in tar extraction with PAX headers
uv has differential in tar extraction with PAX headers
### Impact
In versions 0.9.4 and earlier of uv, tar archives containing PAX headers with file size overrides were not handled properly. As a result, an attacker could contrive a source distribution (as a tar archive) that would extract differently when installed via uv versus other Python package installers.
The underlying parsing differential here originates with astral-tokio-tar, which disclosed this vulnerability as CVE-2025-62518.
In practice, the impact of this vulnerability is **low**: only source distributions can be formatted as tar archives, and source distributions execute arbitrary code at build/installation time by definition. Consequently, a parser differential in tar extraction is strictly less powerful than the capab
OSV
CVE-2025-62518: astral-tokio-tar is a tar archive reading/writing library for async Rust
osv·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] CVE-2025-62518: astral-tokio-tar is a tar archive reading/writing library for async Rust
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
OSV
astral-tokio-tar Vulnerable to PAX Header Desynchronization
osv·2025-10-21
CVE-2025-62518 [HIGH] astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar Vulnerable to PAX Header Desynchronization
## Summary
Versions of `astral-tokio-tar` prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers.
This vulnerability was disclosed to multiple Rust tar parsers, all derived from the original `async-tar` fork of `tar-rs`.
## Details
### Vulnerability Description
The vulnerability stems from inconsistent handling of PAX extended headers versus ustar heade
GHSA
uv has differential in tar extraction with PAX headers
ghsa·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] CWE-843 uv has differential in tar extraction with PAX headers
uv has differential in tar extraction with PAX headers
### Impact
In versions 0.9.4 and earlier of uv, tar archives containing PAX headers with file size overrides were not handled properly. As a result, an attacker could contrive a source distribution (as a tar archive) that would extract differently when installed via uv versus other Python package installers.
The underlying parsing differential here originates with astral-tokio-tar, which disclosed this vulnerability as CVE-2025-62518.
In practice, the impact of this vulnerability is **low**: only source distributions can be formatted as tar archives, and source distributions execute arbitrary code at build/installation time by definition. Consequently, a parser differential in tar extraction is strictly less powerful than the capab
OSV
astral-tokio-tar Vulnerable to PAX Header Desynchronization
osv·2025-10-21
CVE-2025-62518 astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar Vulnerable to PAX Header Desynchronization
Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing
vulnerability that allows attackers to smuggle additional archive entries by
exploiting inconsistent PAX/ustar header handling. When processing archives with
PAX-extended headers containing size overrides, the parser incorrectly advances
stream position based on ustar header size (often zero) instead of the
PAX-specified size, causing it to interpret file content as legitimate tar
headers.
This vulnerability was disclosed to multiple Rust tar parsers, all derived from
the original async-tar fork of tar-rs.
For additional information see
[Edera's blog post](https://edera.dev/stories/tarmageddon).
OSV
`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling
osv·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] `tokio-tar` parses PAX extended headers incorrectly, allows file smuggling
`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling
The archive reader incorrectly handles PAX extended headers, when the ustar
header incorrectly specifies zero size (`size=000000000000`), while a PAX
header specifies a non-zero size, `tokio-tar::Archive` is going to read the
file content as tar entry header.
This can be used by a tar file to present different content to `tokio-tar`
compared to other tar reader implementations.
This bug is also known as `CVE-2025-62518` and `GHSA-j5gw-2vrg-8fgx`, as those
crates share a common ancestor codebase.
The `tokio-tar` crate is archived and no longer maintained, we recommend you
switch to an alternative crate such as:
- [`astral-tokio-tar`](https://crates.io/crates/astral-tokio-tar)
GHSA
astral-tokio-tar Vulnerable to PAX Header Desynchronization
ghsa·2025-10-21
CVE-2025-62518 [HIGH] CWE-843 astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar Vulnerable to PAX Header Desynchronization
## Summary
Versions of `astral-tokio-tar` prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers.
This vulnerability was disclosed to multiple Rust tar parsers, all derived from the original `async-tar` fork of `tar-rs`.
## Details
### Vulnerability Description
The vulnerability stems from inconsistent handling of PAX extended headers versus ustar heade
Debian
CVE-2026-33055: rust-tar - tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and be...
vendor_debian·2026·CVSS 8.1
CVE-2026-33055 [HIGH] CVE-2026-33055: rust-tar - tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and be...
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives a
Red Hat
astral-tokio-tar: astral-tokio-tar Vulnerable to PAX Header Desynchronization
vendor_redhat·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] CWE-843 astral-tokio-tar: astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar: astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
astral-tokio-tar contains a boundary parsing vulnerability that allows attackers to smuggle additional archive
Microsoft
astral-tokio-tar Vulnerable to PAX Header Desynchronization
vendor_msrc·2025-10-14·CVSS 8.1
CVE-2025-62518 [HIGH] CWE-843 astral-tokio-tar Vulnerable to PAX Header Desynchronization
astral-tokio-tar Vulnerable to PAX Header Desynchronization
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Debian
CVE-2025-62518: rust-astral-tokio-tar - astral-tokio-tar is a tar archive reading/writing library for async Rust. Versio...
vendor_debian·2025·CVSS 8.1
CVE-2025-62518 [HIGH] CVE-2025-62518: rust-astral-tokio-tar - astral-tokio-tar is a tar archive reading/writing library for async Rust. Versio...
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
Scope: local
forky: resolved (fixed in 0.5.6-1)
sid: resolved (fixed in 0.5.6-1)
trixie: open
No detection rules found.
No public exploits indexed.
arXiv
Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source ForksWith Global History Analysis
arxiv_fulltext·2026-01-28
Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source ForksWith Global History Analysis
195
195
41
4.76
2
1
100
1
3
100
51.3%
51%
8
4.1%
4%
5
2.6%
3%
5
2.6%
3%
5
2.6%
3%
4
2.1%
2%
4
2.1%
2%
4
2.1%
2%
4
2.1%
2%
4
2.1%
2%
3
1.5%
2%
3
1.5%
2%
3
1.5%
2%
3
1.5%
2%
3
1.5%
2%
3
1.5%
2%
3
1.5%
2%
2
1.0%
1%
2
1.0%
1%
2
1.0%
1%
2
1.0%
1%
2
1.0%
1%
2
1.0%
1%
2
1.0%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
1
0.5%
1%
135
60
195
0.69
69
0.48
0.59
52
35
87
0.6
60
0.6
9
8
4
13
0.69
69
[Detecting One-day Vulnerabilities in Open-source Forks With Global History Analysis]Did You Forkget It? Detecting One-Day Vulnerabilities in Open-source Forks With Global History Analysis
[Lefeuvre]Romain Lefeuvre
University of Rennes
Rennes
France
[email protected]
[Reux]Char
Bugzilla
CVE-2025-62518 kata-containers: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42]
bugzilla·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] CVE-2025-62518 kata-containers: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42]
CVE-2025-62518 kata-containers: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy t
Bugzilla
CVE-2025-62518 trustee-guest-components: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42]
bugzilla·2025-10-21·CVSS 8.1
CVE-2025-62518 [HIGH] CVE-2025-62518 trustee-guest-components: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42]
CVE-2025-62518 trustee-guest-components: astral-tokio-tar Vulnerable to PAX Header Desynchronization [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's
Checkpoint
27th October – Threat Intelligence Report
blogs_checkpoint·2025-10-27
CVE-2025-33073 27th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 27th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 27th October, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Toys “R” Us Canada has suffered a data breach that resulted in stolen customer records being leaked on the dark web. The compromised data affects an undisclosed number of individuals and includes names, physical addresses, email addresses, and phone numbers, while account passwords and financial details were not exposed.
Bleepingcomputer
TARmageddon flaw in abandoned Rust library enables RCE attacks
blogs_bleepingcomputer·2025-10-22·CVSS 8.1
CVE-2025-62518 [HIGH] TARmageddon flaw in abandoned Rust library enables RCE attacks
## TARmageddon flaw in abandoned Rust library enables RCE attacks
## Sergiu Gatlan
A high-severity vulnerability in the now-abandoned async-tar Rust library and its forks can be exploited to gain remote code execution on systems running unpatched software.
Tracked as CVE-2025-62518 , this logic flaw results from a desynchronization issue that allows unauthenticated attackers to inject additional archive entries during TAR file extraction.
This occurs specifically when processing nested TAR files with mismatched ustar and PAX extended headers, causing the parser to jump into the file content and mistake it for tar headers, leading to the extraction of attacker-supplied files.
Edera, the cybersecurity company that discovered the vulnerability and dubbed it TARmageddon , explains that th
Wiz
CVE-2026-33055 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.1
CVE-2026-33055 [HIGH] CVE-2026-33055 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33055 :
Rust vulnerability analysis and mitigation
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. Thi
https://edera.dev/stories/tarmageddonhttps://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgxhttps://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9https://github.com/edera-dev/cve-tarmageddon
2025-10-21
Published