CVE-2025-62518

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62518", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-15T15:03:28.134Z", "datePublished": "2025-10-21T16:13:02.646Z", "dateUpdated": "2025-10-22T13:23:33.408Z"}, "containers": {"cna": {"title": "astral-tokio-tar Vulnerable to PAX Header Desynchronization", "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "lang": "en", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx"}, {"name": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9", "tags": ["x_refsource_MISC"], "url": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9"}, {"name": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318", "tags": ["x_refsource_MISC"], "url": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318"}, {"name": "https://edera.dev/stories/tarmageddon", "tags": ["x_refsource_MISC"], "url": "https://edera.dev/stories/tarmageddon"}, {"name": "https://github.com/edera-dev/cve-tarmageddon", "tags": ["x_refsource_MISC"], "url": "https://github.com/edera-dev/cve-tarmageddon"}], "affected": [{"vendor": "astral-sh", "product": "tokio-tar", "versions": [{"version": "< 0.5.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-21T16:13:02.646Z"}, "descriptions": [{"lang": "en", "value": "astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds."}], "source": {"advisory": "GHSA-j5gw-2vrg-8fgx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T13:18:16.414919Z", "id": "CVE-2025-62518", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T13:23:33.408Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62518", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-22T13:18:16.414919Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T16:35:11.190Z"}}], "cna": {"title": "astral-tokio-tar Vulnerable to PAX Header Desynchronization", "source": {"advisory": "GHSA-j5gw-2vrg-8fgx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "astral-sh", "product": "tokio-tar", "versions": [{"status": "affected", "version": "< 0.5.6"}]}], "references": [{"url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx", "name": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9", "name": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318", "name": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318", "tags": ["x_refsource_MISC"]}, {"url": "https://edera.dev/stories/tarmageddon", "name": "https://edera.dev/stories/tarmageddon", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/edera-dev/cve-tarmageddon", "name": "https://github.com/edera-dev/cve-tarmageddon", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-21T16:13:02.646Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62518", "state": "PUBLISHED", "dateUpdated": "2025-10-22T13:23:33.408Z", "dateReserved": "2025-10-15T15:03:28.134Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-21T16:13:02.646Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "tokio-tar", "vendor": "astral-sh", "versions": [{"status": "affected", "version": "< 0.5.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds."}, {"lang": "es", "value": "astral-tokio-tar es una biblioteca de lectura/escritura de archivos tar para Rust as\u00edncrono. Las versiones de astral-tokio-tar anteriores a la 0.5.6 contienen una vulnerabilidad de an\u00e1lisis de l\u00edmites que permite a los atacantes introducir entradas de archivo adicionales explotando un manejo inconsistente de las cabeceras PAX/ustar. Al procesar archivos con cabeceras PAX extendidas que contienen anulaciones de tama\u00f1o, el analizador avanza incorrectamente la posici\u00f3n del flujo bas\u00e1ndose en el tama\u00f1o de la cabecera ustar (a menudo cero) en lugar del tama\u00f1o especificado por PAX, lo que hace que interprete el contenido del archivo como cabeceras tar leg\u00edtimas. Este problema ha sido parcheado en la versi\u00f3n 0.5.6. No hay soluciones alternativas."}], "id": "CVE-2025-62518", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62518", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T13:18:16.414919Z", "version": "2.0.3"}}]}, "published": "2025-10-21T17:15:40.563", "references": [{"source": "security-advisories@github.com", "url": "https://edera.dev/stories/tarmageddon"}, {"source": "security-advisories@github.com", "url": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318"}, {"source": "security-advisories@github.com", "url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx"}, {"source": "security-advisories@github.com", "url": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9"}, {"source": "security-advisories@github.com", "url": "https://github.com/edera-dev/cve-tarmageddon"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "astral-tokio-tar: astral-tokio-tar Vulnerable to PAX Header Desynchronization", "id": "2405382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405382"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-843", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-62518", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Affected", "package_name": "openshift-sandboxed-containers/osc-monitor-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Affected", "package_name": "openshift-sandboxed-containers/osc-operator-bundle", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Affected", "package_name": "openshift-sandboxed-containers/osc-podvm-builder-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Affected", "package_name": "openshift-sandboxed-containers/osc-rhel9-operator", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "trustee-guest-components", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "kata-containers", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-10-21T16:13:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-62518\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-62518\nhttps://edera.dev/stories/tarmageddon\nhttps://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318\nhttps://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx\nhttps://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9\nhttps://github.com/edera-dev/cve-tarmageddon"], "threat_severity": "Important"}

{"created": "2025-10-23T10:13:04.999099+00:00", "updated": "2025-10-23T10:13:04.999124+00:00", "vendors": ["astral", "astral$PRODUCT$tokio-tar"]}