{"id":"RUSTSEC-2025-0111","revision":"bbcdc9b85a5446849e5e77a8bc24a08c","records":[{"revision":"bbcdc9b85a5446849e5e77a8bc24a08c","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2025-0111","aliases":["CVE-2025-62518","GHSA-j5gw-2vrg-8fgx","RUSTSEC-2025-0110"],"title":"`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling","description":"The archive reader incorrectly handles PAX extended headers, when the ustar\nheader incorrectly specifies zero size (`size=000000000000`), while a PAX\nheader specifies a non-zero size, `tokio-tar::Archive` is going to read the\nfile content as tar entry header.\n\nThis can be used by a tar file to present different content to `tokio-tar`\ncompared to other tar reader implementations.\n\nThis bug is also known as `CVE-2025-62518` and `GHSA-j5gw-2vrg-8fgx`, as those\ncrates share a common ancestor codebase.\n\nThe `tokio-tar` crate is archived and no longer maintained, we recommend you\nswitch to an alternative crate such as:\n- [`astral-tokio-tar`](https://crates.io/crates/astral-tokio-tar)","state":0,"publishedAt":"2025-10-21T12:00:00+00:00","modifiedAt":"2026-02-04T02:35:07.255927+00:00","affected":[{"ecosystem":"crates.io","name":"tokio-tar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/tokio-tar","https://rustsec.org/advisories/RUSTSEC-2025-0111.html","https://edera.dev/stories/tarmageddon"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2025-0111","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2025-0111","identifiers":["RUSTSEC-2025-0111","CVE-2025-62518","GHSA-j5gw-2vrg-8fgx","RUSTSEC-2025-0110"]},"retained":false,"historicalAffected":[]}],"coverage":[]}