Log in Start free

Vulnerability · Published Oct 21, 2025 · Assigned by GitHub_M

CVE-2025-62518astral-tokio-tar Vulnerable to PAX Header Desynchronization

High 8.1

In plain English

A high-severity type confusion in tokio-tar from astral-sh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 46.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13rust-astral-tokio-tarno fix listedDEBIAN-CVE-2025-62518
Debian:14rust-astral-tokio-tar0.5.6-1DEBIAN-CVE-2025-62518
Ubuntu:25.10rust-astral-tokio-tarno fix listedUBUNTU-CVE-2025-62518
Ubuntu:26.04:LTSrust-astral-tokio-tarno fix listedUBUNTU-CVE-2025-62518

Affected products (as reported)

VendorProductVersions
astral-sh tokio-tar < 0.5.6

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References