CVE-2025-62518

🗓️ 21 Oct 2025 16:13:02Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 13 Media mentions👁 52 Views🌐 WEB

Older astral-tokio-tar versions before 0.5.6 are vulnerable to PAX header desynchronization; patch in 0.5.6; no workarounds.

Reporter	Title	Published	Views	Family All 154
ATTACKERKB	CVE-2026-33055	20 Mar 202607:06	–	attackerkb
Amazon	Medium: rust	14 Apr 202600:00	–	amazon
Amazon	Medium: clamav1.5	13 Apr 202600:00	–	amazon
Amazon	Medium: rust-cargo-c	13 Apr 202600:00	–	amazon
Amazon	Medium: rust-below	13 Apr 202600:00	–	amazon
Amazon	Medium: rust	13 Apr 202600:00	–	amazon
Chainguard	CVE-2025-62518 vulnerabilities	22 Oct 202513:25	–	cgr
Circl	CVE-2025-62518	21 Oct 202514:28	–	circl
CNNVD	astral-tokio-tar 安全漏洞	21 Oct 202500:00	–	cnnvd
CNNVD	tar-rs 安全漏洞	20 Mar 202600:00	–	cnnvd

Vulners

Node

astral-sh tokio-tarRange<0.5.6

[
  {
    "vendor": "astral-sh",
    "product": "tokio-tar",
    "versions": [
      {
        "version": "< 0.5.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
edera	www.edera.dev/stories/tarmageddon
github	www.github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318
github	www.github.com/edera-dev/cve-tarmageddon
github	www.github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
github	www.github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx

Parameter	Position	Path	Description	CWE
path	path	vulnerable-extract	Tar archive parsing vulnerability in vulnerable-extract when processing PAX headers can be exploited by a crafted tar (smuggling content).	CWE-843
path	path	malicious-payload	Malicious tar payload used to demonstrate the vulnerability by smuggling content into an extraction process.	CWE-843
path	path	reproduce.sh	Reproduce script that automates the exploit workflow against the vulnerable-extract tool.	CWE-843

17 Jun 2026 09:52Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

EPSS0.00688

SSVC

CWE-843