astral-tokio-tar Vulnerable to PAX Header Desynchronization

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-62518 · Microsoft / collected KEV context

EUVD-2025-35176

GHSA-j5gw-2vrg-8fgx

RUSTSEC-2025-0110

RUSTSEC-2025-0111

cve-program · CVE-2025-62518

• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx
• https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
• https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318
• https://edera.dev/stories/tarmageddon
• https://github.com/edera-dev/cve-tarmageddon

euvd · EUVD-2025-35176

• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx
• https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
• https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318
• https://edera.dev/stories/tarmageddon
• https://github.com/edera-dev/cve-tarmageddon

nvd · CVE-2025-62518

• https://edera.dev/stories/tarmageddon
• https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318
• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx
• https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
• https://github.com/edera-dev/cve-tarmageddon

osv · GHSA-j5gw-2vrg-8fgx

• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx
• https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
• https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318
• https://edera.dev/stories/tarmageddon
• https://github.com/astral-sh/tokio-tar
• https://github.com/edera-dev/cve-tarmageddon
• https://rustsec.org/advisories/RUSTSEC-2025-0110.html
• https://rustsec.org/advisories/RUSTSEC-2025-0111.html

osv · RUSTSEC-2025-0110

• https://crates.io/crates/astral-tokio-tar
• https://rustsec.org/advisories/RUSTSEC-2025-0110.html
• https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318

osv · RUSTSEC-2025-0111

• https://crates.io/crates/tokio-tar
• https://rustsec.org/advisories/RUSTSEC-2025-0111.html
• https://edera.dev/stories/tarmageddon

No related operational record is retained in the current change model.