astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-4154ea83d0 advisory.

    ## uv / python-uv-build 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## Pydantic 2.12.3

    [Blog post](https://pydantic.dev/articles/pydantic-v2-12-release)

    ----

    ## maturin 1.9.6

    https://github.com/PyO3/maturin/blob/v1.9.6/Changelog.md

    ----

    ## python-typing-inspection 0.4.2 (2025-10-01)

    - Add `typing_objects.is_noextraitems()`

    ----

    ## python-jiter 0.11.0

    https://github.com/pydantic/jiter/releases/tag/v0.11.0

    ----

    ## python-pydantic-extra-types 2.10.6

    https://github.com/pydantic/pydantic-extra-types/releases/tag/v2.10.6

    ----

    # Typer

    ## 0.20.0

    ### Features

    *  Enable command suggestions on typo by default.

    ### Upgrades

    *  Add (official) support for Python 3.14.

    ### Internal

    Assorted small enhancements.

    ----

    # FastAPI

    ## 0.120.1

    ### Upgrades

    *  Bump Starlette to <`0.50.0`.

    ### Internal

    *  Add `license` and `license-files` to `pyproject.toml`, remove `License` from `classifiers`.

    ## 0.120.0

    There are no major nor breaking changes in this release. 

    The internal reference documentation now uses `annotated_doc.Doc` instead of `typing_extensions.Doc`, this     adds a new (very small) dependency on [`annotated-doc`](https://github.com/fastapi/annotated-doc), a     package made just to provide that `Doc` documentation utility class.

    I would expect `typing_extensions.Doc` to be deprecated and then removed at some point from     `typing_extensions`, for that reason there's the new `annotated-doc` micro-package. If you are curious     about this, you can read more in the repo for [`annotated-doc`](https://github.com/fastapi/annotated-doc).

    This new version `0.120.0` only contains that transition to the new home package for that utility class     `Doc`.

    ### Translations, Internal

    Assorted improvements.

    ## 0.119.1

    ### Fixes

    *  Fix internal Pydantic v1 compatibility (warnings) for Python 3.14 and Pydantic 2.12.1.

    ### Docs, Internal

    Assorted improvements.

    ## 0.119.0

    FastAPI now (temporarily) supports both Pydantic v2 models and `pydantic.v1` models at the same time in     the same app, to make it easier for any FastAPI apps still using Pydantic v1 to gradually but quickly
    **migrate to Pydantic v2**.

    ### Features

    *  Add support for `from pydantic.v1 import BaseModel`, mixed Pydantic v1 and v2 models in the same     app.

    ## 0.118.3

    ### Upgrades

    - Add (official) support for Python 3.14.

    ## 0.118.2

    ### Fixes

    *  Fix tagged discriminated union not recognized as body field.

    ## 0.118.1

    ### Upgrades

    *  Ensure compatibility with Pydantic 2.12.0.

    ### Docs, Translations, Internal

    Assorted bugfixes and enhancements.

    ## 0.118.0

    ### Fixes

    *  Fix support for `StreamingResponse`s with dependencies with `yield` or `UploadFile`s, close after     the response is done.

    Before FastAPI 0.118.0, if you used a dependency with `yield`, it would run the exit code after the *path     operation function* returned but right before sending the response.

    This change also meant that if you returned a `StreamingResponse`, the exit code of the dependency with     `yield` would have been already run.

    For example, if you had a database session in a dependency with `yield`, the `StreamingResponse` would not     be able to use that session while streaming data because the session would have already been closed in the     exit code after `yield`.

    This behavior was reverted in 0.118.0, to make the exit code after `yield` be executed after the response     is sent.

    You can read more about it in the docs for [Advanced Dependencies - Dependencies with `yield`,     `HTTPException`, `except` and Background Tasks](https://fastapi.tiangolo.com/advanced/advanced-     dependencies#dependencies-with-yield-httpexception-except-and-background-tasks). Including what you could     do if you wanted to close a database session earlier, before returning the response to the client.

    ### Docs, Translations, Internal

    Assorted bugfixes and enhancements.

    ----

    # Starlette

    ## 0.49.1 (October 28, 2025)

    This release fixes a security vulnerability in the parsing logic of the `Range` header in `FileResponse`.

    You can view the full security advisory: [GHSA-7f5h-v6xp-     fcq8](https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8)

    #### Fixed

    * Optimize the HTTP ranges parsing logic.

    ## 0.49.0 (October 28, 2025)

    #### Added

    * Add `encoding` parameter to `Config` class.
    * Support multiple cookie headers in `Request.cookies`.
    * Use `Literal` type for `WebSocketEndpoint` encoding values.

    #### Changed

    * Do not pollute exception context in `Middleware` when using `BaseHTTPMiddleware`.

    ----

    # FastAPI CLI

    ## 0.0.14

    ### Upgrades

    *  Add support for Python 3.13 and 3.14.

    ----

    # FastAPI Cloud CLI

    ## 0.3.1

    ### Fixes

    *  Fix login url not linked correctly.

    ### Refactors

    *  Refactor env vars creation.
    *  Remove env vars from deploy workflow.

    ### Internal

    *  Log files added to archive in debug mode.
    *  Add test to make sure .fastapicloudignore can override .gitignore.

    ## 0.3.0

    ### Features

    -  Add support for `.fastapicloudignore` file.

    ## 0.2.1

    ### Features

    *  Add support for verification statuses.

    ----

    ## `python-rignore`

    ### 0.7.1

    - Add support for overrides

    ### 0.7.0

    - Update PyO3 to 0.26

    ----

    # python-inline-snapshot

    ## 0.30.1  2025-10-20

    Fixed
    -----

    - Disable ensure ascii in json.dump to support non-ASCII characters in external files

    ## 0.30.0  2025-10-15

    Added
    -----

    - The `test-dir` config option can now also be a list of paths
    - added (official) Python 3.14 support

    ## 0.29.4  2025-10-13

    Changed
    -------

    - `External.run_inline()` now uses the same logic as `External.run_pytest`.

    Fixed
    -----

    - inline-snapshot now supports different Python file encodings and recognizes     encoding comments such as `# -*- coding: windows-1251 -*-`

    ## 0.29.3  2025-10-04

    Fixed
    -----

    - xdist is now detected properly.

    ## 0.29.2  2025-10-01

    Fixed
    -----

    - fixed string formatting with black which caused invalid snapshots


    ----

    ## rust-regex 1.11.3 (2025-09-25)

    This is a small patch release with an improvement in memory usage in some     cases.

    **Improvements:**

    * Improve memory usage by trimming excess memory capacity in some spots.

    ----

    ## rust-speedate 0.17.0

    - feat: add new from float with config func
    - Derive Copy on Date, Time and DateTime

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Update `rust-regex-automata` to 0.4.11
    - Update `rust-serde_json` to 1.0.145
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1
    - Update `python-pydantic-core` to 2.41.4
    - Update `openapi-python-client` to 0.26.2 and patch it to allow `ruff` 0.14 and `typer` 0.20
    - Initial package for `python-cron-converter`
    - Initial packages for a number of new Rust library dependencies for `ruff` and `uv`












Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-43a0bff5ea advisory.

    ## uv 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518.

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Initial package for `python-uv-build` in Fedora 42
    - Initial packages for a number of new dependencies for `ruff` and `uv`.
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1.
    - Patch `openapi-python-client` to allow `ruff` 0.14


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-a77c1f005b advisory.

    ## uv 0.9.5

    https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md

    Since uv was built with astral-tokio-tar 0.5.6, this is a security fix for CVE-2025-62518.

    ----

    ## ruff 0.14.2

    https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md

    ----

    ## rust-astral-tokio-tar 0.5.6

    * Fixed a parser desynchronization vulnerability when reading tar archives that       contain mismatched size information in PAX/ustar headers.

        This vulnerability is being tracked as     [GHSA-j5gw-2vrg-8fgx](https://github.com/advisories/GHSA-j5gw-2vrg-8fgx)         and CVE-2025-62518.

    ----

    - Initial package for `python-uv-build` in Fedora 42
    - Initial packages for a number of new dependencies for `ruff` and `uv`
    - Update `rust-tikv-jemallocator` and `rust-tikv-jemalloc-sys` to 0.6.1
    - Update `openapi-python-client` to 0.26.2 and patch it to allow `ruff` 0.14

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar     prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional     archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-     extended headers containing size overrides, the parser incorrectly advances stream position based on ustar     header size (often zero) instead of the PAX-specified size, causing it to interpret file content as     legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
    (CVE-2025-62518)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
272299	Fedora 43 : fastapi-cli / fastapi-cloud-cli / gherkin / maturin / etc (2025-4154ea83d0)	Nessus	Fedora Local Security Checks	high
272181	Fedora 41 : openapi-python-client / python-uv-build / ruff / etc (2025-43a0bff5ea)	Nessus	Fedora Local Security Checks	high
272180	Fedora 42 : openapi-python-client / python-uv-build / ruff / etc (2025-a77c1f005b)	Nessus	Fedora Local Security Checks	high
271650	Linux Distros Unpatched Vulnerability : CVE-2025-62518	Nessus	Misc.	high

Detections

Analytics

CVE-2025-62518

high

Tenable Plugins

high

high

high

high