CVE-2025-62518 - CVE House
Back to Database
Status published High CVE-2025-62518

astral-tokio-tar Vulnerable to PAX Header Desynchronization

Vulnerability Description

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62518

Credits & Attribution

No credits recorded in the NVD database.

References

More from astral-sh

View All →
CVE-2025-59825
astral-tokio-tar has a path traversal in tar extraction
Medium 6.1
CVE-2025-54368
uv is vulnerable to ZIP payload obfuscation through parsing differentials
Medium 6.8
CVE-2025-13327
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
Medium 6.3

Affected Vendor

Affected Software

tokio-tar
Vulnerable Versions:
< 0.5.6

Timeline

Official Publish: October 21st, 2025
Last Modified: October 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-843

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1499 Endpoint Denial of Service
Impact