{"id":"EUVD-2025-35176","enisaUuid":"1c193365-4a4b-3c31-9e35-32ce39edaca3","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.","datePublished":"Oct 21, 2025, 4:13:02 PM","dateUpdated":"Oct 22, 2025, 1:23:33 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx\nhttps://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9\nhttps://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318\nhttps://edera.dev/stories/tarmageddon\nhttps://github.com/edera-dev/cve-tarmageddon\n","aliases":"CVE-2025-62518\nGHSA-j5gw-2vrg-8fgx\n","assigner":"GitHub_M","epss":0.7,"enisaIdProduct":[{"id":"3c459969-637a-35e1-acec-f43df17d5aba","product":{"name":"tokio-tar","vendor":{"name":"astral-sh"}},"product_version":"\u003c 0.5.6"}],"enisaIdVendor":[{"id":"fbed8148-788c-38d4-9dd7-51b7252ac82b","vendor":{"name":"astral-sh"}}],"enisaIdVulnerability":[{"id":"40b80b2e-10bd-3df5-bf3a-fd6f42835182","vulnerability":{"id":"GHSA-j5gw-2vrg-8fgx","description":"astral-tokio-tar Vulnerable to PAX Header Desynchronization","datePublished":"Oct 21, 2025, 3:42:51 PM","dateUpdated":"Jan 16, 2026, 10:12:12 PM","baseScore":0.0,"references":"https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx\nhttps://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9\nhttps://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318\nhttps://edera.dev/stories/tarmageddon\nhttps://github.com/astral-sh/tokio-tar\nhttps://github.com/edera-dev/cve-tarmageddon\nhttps://rustsec.org/advisories/RUSTSEC-2025-0110.html\nhttps://rustsec.org/advisories/RUSTSEC-2025-0111.html\n","enisa_id":"EUVD-2025-35176\n","aliases":"GHSA-j5gw-2vrg-8fgx\nCVE-2025-62518\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a1b1ba15-9ccd-3a36-bc69-8113085da1c1","vulnerability":{"id":"CVE-2025-62518","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.","datePublished":"Oct 21, 2025, 4:13:02 PM","dateUpdated":"Oct 22, 2025, 1:23:33 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","references":"https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx\nhttps://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9\nhttps://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318\nhttps://edera.dev/stories/tarmageddon\nhttps://github.com/edera-dev/cve-tarmageddon\n","enisa_id":"EUVD-2025-35176\n","assigner":"GitHub_M","epss":0.7,"dataProcessed":"Nov 1, 2026, 1:37:51 AM","vulnerabilityProduct":[{"id":"c5224b35-5578-35bf-87f5-a2ee77c4beef","product":{"name":"tokio-tar","vendor":{"name":"astral-sh"}},"product_version":"\u003c 0.5.6"}],"vulnerabilityVendor":[{"id":"4bae34aa-80c1-3b05-a3ab-6177552d5d4e","vendor":{"name":"astral-sh"}}]}}],"enisaIdAdvisory":[{"id":"886ca047-966d-309e-8518-875baf54d0f0","advisory":{"id":"openSUSE-SU-2025:15658-1","description":"python311-uv-0.9.5-1.1 on GA media","summary":"python311-uv-0.9.5-1.1 on GA media","datePublished":"Oct 22, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:43:41 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15658-1.json\nhttps://www.suse.com/security/cve/CVE-2025-62518/\n","aliases":"CVE-2025-62518\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"002f743e-0442-3d69-b2b3-7d9690c1f005","product":{"name":"uv-bash-completion-0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"09264b55-4cd7-3542-8532-30dc0b213d8c","product":{"name":"python312-uv-0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"0a8d7564-8678-383d-b55f-7d2650aa6a88","product":{"name":"uv-fish-completion-0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"0ba5ec69-1065-38c1-bc74-c8fb6401fc0f","product":{"name":"uv-fish-completion-0:0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"1337f0c3-e05d-37e6-abda-23108b86ef0d","product":{"name":"uv-fish-completion-0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"14536d68-a3f6-35f7-9695-5991335c7346","product":{"name":"python313-uv-0:0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2ac4d703-62c1-3edc-a122-5579ccf2708b","product":{"name":"uv-zsh-completion-0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"2e96e58b-0481-376d-9837-8057fc000dbe","product":{"name":"python312-uv-0:0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"361e8548-a3cb-3df6-aa01-293f19f5a066","product":{"name":"uv-bash-completion-0:0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3aac1127-b530-3681-8067-676887c44e45","product":{"name":"uv-bash-completion-0:0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"3ba0c2a4-b459-39ec-ae9a-414b44f0ad2e","product":{"name":"python313-uv-0:0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4076d5b1-d15b-3191-832d-866fa38040b3","product":{"name":"python311-uv-0:0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"40c572c1-4c39-3b1c-b8ce-1c7450030354","product":{"name":"python313-uv-0:0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"450d340c-22bf-3859-8ebc-5bf1c19be9ee","product":{"name":"uv-fish-completion-0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4a2faff1-2ad0-34cb-83b5-f362c3657f60","product":{"name":"python311-uv-0:0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4c489fb7-b327-3d97-a399-3b96f5e2e6c9","product":{"name":"uv-fish-completion-0:0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"51382b25-aa46-3c1f-bd5f-fded11f501d1","product":{"name":"python312-uv-0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"5eca0b79-3b8f-376e-bdcc-72a1f3bead11","product":{"name":"uv-fish-completion-0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6b8700a1-3a46-34ad-8490-2c0a72f34014","product":{"name":"uv-zsh-completion-0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"73542738-dbb7-3d13-92e8-becb970dce34","product":{"name":"uv-fish-completion-0:0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"76197e00-8aa0-35cb-93f9-7b299b218a8d","product":{"name":"python312-uv-0:0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"85d66b0a-8d5b-3757-bc12-9c2a76ebd85c","product":{"name":"uv-zsh-completion-0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"876e648a-8f41-3ad5-912a-6290540cb03b","product":{"name":"uv-bash-completion-0:0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"87fdcff2-239e-3d58-8714-4c0e28998f3d","product":{"name":"uv-zsh-completion-0:0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"88199912-b3c0-39f8-a415-6bd0ce841803","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"8a27ce3c-d9dc-3908-822d-df361634d277","product":{"name":"uv-zsh-completion-0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8c031b28-669d-33a4-bb6a-dac0578023f2","product":{"name":"uv-bash-completion-0:0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8e6e32fc-3deb-3039-818c-dddcf9c194dd","product":{"name":"uv-bash-completion-0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"92082c10-4d0b-3c62-9e67-035afabf70fc","product":{"name":"python313-uv-0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9259cb9a-8897-31e0-b08d-074da8c079ad","product":{"name":"python313-uv-0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"995d3502-d3d3-3dbd-b46a-e19a781770de","product":{"name":"uv-bash-completion-0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"99b7829a-a499-34c8-92b2-266ca3a63b5b","product":{"name":"uv-fish-completion-0:0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"9afa9b62-391d-3c35-84a6-573732891b36","product":{"name":"python311-uv-0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a25eb704-9854-3410-9d4c-d57c038d4b0c","product":{"name":"python313-uv-0:0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a68476da-1289-3e52-9271-e4886af62424","product":{"name":"python311-uv-0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a865a596-6d80-3ad6-8846-e30f4d6a0ce8","product":{"name":"python312-uv-0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ae0dbda1-05ef-307a-93ad-44bb565cb362","product":{"name":"python311-uv-0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b54f8354-26f0-3802-ba62-3b1584ad5a74","product":{"name":"python313-uv-0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c4ed7125-2ff6-317c-b207-066f64d9bbf7","product":{"name":"python313-uv-0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c69c2547-c1ce-3ebb-b4b7-06d52725c80d","product":{"name":"uv-bash-completion-0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c8f967aa-b5bd-3a02-987c-2e680dd67f11","product":{"name":"python312-uv-0:0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c94b1c19-13a8-3592-a579-6f1a95ed79da","product":{"name":"python311-uv-0:0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"cdc5a3e3-5b43-3f44-961e-adecdfa6b652","product":{"name":"uv-zsh-completion-0:0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d241c79f-62f6-3471-b929-23f637c088e7","product":{"name":"uv-zsh-completion-0:0.9.5-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d2679f4f-5fef-3356-82f8-762fcfc5883f","product":{"name":"python311-uv-0.9.5-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d3d43877-6d47-3df5-bff8-46a45055536d","product":{"name":"python311-uv-0:0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"eeb9f07e-cb63-33d7-b7e6-0f8f0fb4feea","product":{"name":"uv-zsh-completion-0:0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"eefecf3c-bd96-3d1c-a124-77727df10ab4","product":{"name":"python312-uv-0:0.9.5-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fb2c37b9-60e8-3d71-9b8b-1abbcc6ed466","product":{"name":"python312-uv-0.9.5-1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"ab658d64-7180-3a74-80f6-d4ec045c3a5c","advisory":{"id":"openSUSE-SU-2026:20026-1","description":"Security update for python-uv","summary":"Security update for python-uv","datePublished":"Jan 13, 2026, 12:48:04 PM","dateUpdated":"Sep 17, 2026, 5:25:17 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20026-1.json\nhttps://bugzilla.suse.com/1249011\nhttps://bugzilla.suse.com/1252399\nhttps://www.suse.com/security/cve/CVE-2025-58160/\nhttps://www.suse.com/security/cve/CVE-2025-62518/\n","aliases":"CVE-2025-58160\nCVE-2025-62518\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"09be0ae9-24ff-3650-b1ef-7248bdcd5950","product":{"name":"python313-uv-0:0.7.18-160000.3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"3181d126-0292-3384-b336-e962bcfb6ae5","product":{"name":"python313-uv-0:0.7.18-160000.3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"34c5747f-caf3-3adf-ab37-8f4de454496e","product":{"name":"python313-uv-0.7.18-160000.3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"401d2e5a-58bb-3f6d-a9aa-28bc74a87532","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"457e3160-d6b2-36c9-b8dc-a9a6ff271e68","product":{"name":"python313-uv-0.7.18-160000.3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6302b603-4d49-38e1-8e28-f96b72fd7881","product":{"name":"python313-uv-zsh-completion-0:0.7.18-160000.3.1.noarch","vendor":{"name":"SUSE"}}},{"id":"6f3ab5a7-bc9d-3efb-9d25-1cbbf17e7266","product":{"name":"python313-uv-0.7.18-160000.3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"75c492ec-c946-38c9-8466-5bc1735df623","product":{"name":"python313-uv-bash-completion-0.7.18-160000.3.1.noarch","vendor":{"name":"SUSE"}}},{"id":"90282345-6f0b-3c1e-a44c-60aafd78d498","product":{"name":"python313-uv-bash-completion-0:0.7.18-160000.3.1.noarch","vendor":{"name":"SUSE"}}},{"id":"92a4542f-1651-39df-a401-ea0f3f259608","product":{"name":"python313-uv-fish-completion-0.7.18-160000.3.1.noarch","vendor":{"name":"SUSE"}}},{"id":"96a481ee-bf25-3859-9040-6fe594d4a099","product":{"name":"python313-uv-zsh-completion-0.7.18-160000.3.1.noarch","vendor":{"name":"SUSE"}}},{"id":"970f0d59-77da-3658-bad4-bd7e4ed92ecd","product":{"name":"python313-uv-0:0.7.18-160000.3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"be63633f-bbdd-3495-b99a-feed9b45e2f6","product":{"name":"python313-uv-0:0.7.18-160000.3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"dd762ef8-aa1f-3b16-8322-210eb387edda","product":{"name":"python313-uv-0.7.18-160000.3.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"fdafe7e8-efa8-3496-99f6-afef216a4956","product":{"name":"python313-uv-fish-completion-0:0.7.18-160000.3.1.noarch","vendor":{"name":"SUSE"}}}]}},{"id":"e4f59734-d7b2-36f5-954b-b0eb4715e926","advisory":{"id":"msrc_CVE-2025-62518","description":"astral-tokio-tar Vulnerable to PAX Header Desynchronization","datePublished":"Oct 2, 2025, 12:00:00 AM","dateUpdated":"Jan 20, 2026, 2:45:03 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-62518.json\n","aliases":"CVE-2025-62518\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"45e3bbcd-9e2c-3235-bb9a-3e05a170adcc","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"4a04ef14-0589-34d0-9ebf-086a2f4c9806","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"4ebc8eba-9c3d-3d40-8616-6a0f89cbc881","product":{"name":"kata-containers-cc","vendor":{"name":"Microsoft"}}},{"id":"7f0f1594-875d-3853-a0cf-464e415fd04c","product":{"name":"azl3 kata-containers-cc 3.15.0.aks0-5","vendor":{"name":"Microsoft"}}}]}},{"id":"f5563411-6b1b-33b1-9a8e-2557abccb906","advisory":{"id":"SUSE-SU-2026:20077-1","description":"Security update for python-uv","summary":"Security update for python-uv","datePublished":"Jan 13, 2026, 12:49:17 PM","dateUpdated":"Sep 16, 2026, 7:26:06 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20077-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202620077-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2026-January/023820.html\nhttps://bugzilla.suse.com/1249011\nhttps://bugzilla.suse.com/1252399\nhttps://www.suse.com/security/cve/CVE-2025-58160/\nhttps://www.suse.com/security/cve/CVE-2025-62518/\n","aliases":"CVE-2025-58160\nCVE-2025-62518\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"29427a9b-9ed6-3ed3-a16c-da5611478263","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"42ba9c2d-5544-38b0-ab39-bb4da4842291","product":{"name":"python313-uv-0.7.18-160000.3.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6f403e01-f2f9-31d2-9446-f885c9dd73fe","product":{"name":"python313-uv-0.7.18-160000.3.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7f85d044-0a73-38d4-8739-02b319f77674","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}},{"id":"b381fb74-e6c3-31f6-b37b-ec3508d167cc","product":{"name":"python313-uv-0.7.18-160000.3.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d72c090b-83eb-3b7f-b6b4-877f6d992f15","product":{"name":"python313-uv-0.7.18-160000.3.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}