Detections
Analytics
CVE-2025-62518
high
Description
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
References
https://www.securityweek.com/tarmageddon-flaw-in-popular-rust-library-leads-to-rce/
https://thehackernews.com/2025/10/tarmageddon-flaw-in-async-tar-rust.html
https://securityaffairs.com/183682/hacking/tarmageddon-flaw-in-async-tar-rust-library.html
https://cyberscoop.com/async-tar-rust-open-source-vulnerability/