{"id":"CVE-2025-62518","sourceIdentifier":"security-advisories@github.com","published":"2025-10-21T17:15:40.563","lastModified":"2026-10-08T11:10:00.250","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds."},{"lang":"es","value":"astral-tokio-tar es una biblioteca de lectura/escritura de archivos tar para Rust asíncrono. Las versiones de astral-tokio-tar anteriores a la 0.5.6 contienen una vulnerabilidad de análisis de límites que permite a los atacantes introducir entradas de archivo adicionales explotando un manejo inconsistente de las cabeceras PAX/ustar. Al procesar archivos con cabeceras PAX extendidas que contienen anulaciones de tamaño, el analizador avanza incorrectamente la posición del flujo basándose en el tamaño de la cabecera ustar (a menudo cero) en lugar del tamaño especificado por PAX, lo que hace que interprete el contenido del archivo como cabeceras tar legítimas. Este problema ha sido parcheado en la versión 0.5.6. No hay soluciones alternativas."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"astral-sh","product":"tokio-tar","versions":[{"version":"< 0.5.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-22T13:18:16.414919Z","id":"CVE-2025-62518","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://edera.dev/stories/tarmageddon","source":"security-advisories@github.com"},{"url":"https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318","source":"security-advisories@github.com"},{"url":"https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx","source":"security-advisories@github.com"},{"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9","source":"security-advisories@github.com"},{"url":"https://github.com/edera-dev/cve-tarmageddon","source":"security-advisories@github.com"}]}