Vulnerability-Lookup

rustsec-2025-0111

Vulnerability from osv_rustsec

Published

2025-10-21 12:00

Modified

2026-01-17 07:44

Summary

`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling

Details

The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size (size=000000000000), while a PAX header specifies a non-zero size, tokio-tar::Archive is going to read the file content as tar entry header.

This can be used by a tar file to present different content to tokio-tar compared to other tar reader implementations.

This bug is also known as CVE-2025-62518 and GHSA-j5gw-2vrg-8fgx, as those crates share a common ancestor codebase.

The tokio-tar crate is archived and no longer maintained, we recommend you switch to an alternative crate such as: - astral-tokio-tar

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "format-injection"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "tokio_tar::Archive::new",
            "tokio_tar::ArchiveBuilder::new"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "tokio-tar",
        "purl": "pkg:cargo/tokio-tar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2025-62518",
    "GHSA-j5gw-2vrg-8fgx"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The archive reader incorrectly handles PAX extended headers, when the ustar\nheader incorrectly specifies zero size (`size=000000000000`), while a PAX\nheader specifies a non-zero size, `tokio-tar::Archive` is going to read the\nfile content as tar entry header.\n\nThis can be used by a tar file to present different content to `tokio-tar`\ncompared to other tar reader implementations.\n\nThis bug is also known as `CVE-2025-62518` and `GHSA-j5gw-2vrg-8fgx`, as those\ncrates share a common ancestor codebase.\n\nThe `tokio-tar` crate is archived and no longer maintained, we recommend you\nswitch to an alternative crate such as:\n- [`astral-tokio-tar`](https://crates.io/crates/astral-tokio-tar)",
  "id": "RUSTSEC-2025-0111",
  "modified": "2026-01-17T07:44:05Z",
  "published": "2025-10-21T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/tokio-tar"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0111.html"
    },
    {
      "type": "WEB",
      "url": "https://edera.dev/stories/tarmageddon"
    }
  ],
  "related": [
    "CVE-2025-62518",
    "GHSA-j5gw-2vrg-8fgx"
  ],
  "severity": [],
  "summary": "`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling"
}

GHSA-J5GW-2VRG-8FGX

Vulnerability from github – Published: 2025-10-21 15:42 – Updated: 2026-01-16 22:12

Summary

astral-tokio-tar Vulnerable to PAX Header Desynchronization

Details

Summary

Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers.

This vulnerability was disclosed to multiple Rust tar parsers, all derived from the original async-tar fork of tar-rs.

Details

Vulnerability Description

The vulnerability stems from inconsistent handling of PAX extended headers versus ustar headers when determining file data boundaries. Specifically:

PAX header correctly specifies the file size (e.g., size=1048576)
ustar header incorrectly specifies zero size (size=000000000000)
tokio-tar advances the stream position based on the ustar size (0 bytes)
Inner content is then interpreted as legitimate outer archive entries

Attack Mechanism

When a TAR file contains:

An outer entry with PAX size=N but ustar size=0
File data that begins with valid TAR header structures
The parser treats inner content as additional outer entries

This creates a header/data desynchronization where the parser's position becomes misaligned with actual file boundaries.

Root Cause

// Vulnerable: Uses ustar size instead of PAX override
let file_size = header.size(); // Returns 0 from ustar field
let next_pos = current_pos + 512 + pad_to_512(file_size); // Advances 0 bytes

// Fixed: Apply PAX overrides before position calculation
let mut file_size = header.size();
if let Some(pax_size) = pending_pax.get("size") {
    file_size = pax_size.parse().unwrap();
}
let next_pos = current_pos + 512 + pad_to_512(file_size); // Correct advance

Impact

The impact of this vulnerability depends on where astral-tokio-tar is used, and whether it is used to extract untrusted tar archives. If used to extract untrusted inputs, it may result in unexpected attacker-controlled access to the filesystem, in turn potential resulting in arbitrary code execution or credential exfiltration.

See GHSA-w476-p2h3-79g9 for how this vulnerability affects uv, astral-tokio-tar's primary downstream user. Observe that unlike this advisory,uv's advisory is considered low severity due to overlap with intentional existing capabilities in source distributions.

Workarounds

Users are advised to upgrade to version 0.5.6 or newer to address this advisory.

There is no workaround other than upgrading.

Timeline

Date	Event
Aug 21, 2025	Vulnerability discovered by Edera Security Team
Aug 21, 2025	Initial analysis and PoC confirmed
Aug 22, 2025	Maintainers notified (privately)
Aug 25, 2025	Private patch and test suite shared
Oct 7, 2025	Text freeze for GHSA
Oct 21, 2025	Coordinated public disclosure and patched releases

Credits

Discovered by: Steven Noonan (Edera) and Alex Zenla (Edera)
Coordinated disclosure: Ann Wallace (Edera)

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.5"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "astral-tokio-tar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "tokio-tar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62518"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-843"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-21T15:42:51Z",
    "nvd_published_at": "2025-10-21T17:15:40Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nVersions of `astral-tokio-tar` prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers.\n\nThis vulnerability was disclosed to multiple Rust tar parsers, all derived from the original `async-tar` fork of `tar-rs`.\n\n## Details\n\n### Vulnerability Description\n\nThe vulnerability stems from inconsistent handling of PAX extended headers versus ustar headers when determining file data boundaries. Specifically:\n\n1. **PAX header** correctly specifies the file size (e.g., `size=1048576`)\n2. **ustar header** incorrectly specifies zero size (`size=000000000000`)\n3. **tokio-tar** advances the stream position based on the ustar size (0 bytes)\n4. **Inner content** is then interpreted as legitimate outer archive entries\n\n### Attack Mechanism\n\nWhen a TAR file contains:\n\n- An outer entry with PAX `size=N` but ustar `size=0`\n- File data that begins with valid TAR header structures\n- The parser treats inner content as additional outer entries\n\nThis creates a **header/data desynchronization** where the parser\u0027s position becomes misaligned with actual file boundaries.\n\n### Root Cause\n\n```rust\n// Vulnerable: Uses ustar size instead of PAX override\nlet file_size = header.size(); // Returns 0 from ustar field\nlet next_pos = current_pos + 512 + pad_to_512(file_size); // Advances 0 bytes\n\n// Fixed: Apply PAX overrides before position calculation\nlet mut file_size = header.size();\nif let Some(pax_size) = pending_pax.get(\"size\") {\n    file_size = pax_size.parse().unwrap();\n}\nlet next_pos = current_pos + 512 + pad_to_512(file_size); // Correct advance\n\n```\n\n## Impact\n\nThe impact of this vulnerability depends on where `astral-tokio-tar` is used, and whether it is used to extract untrusted tar archives. If used to extract untrusted inputs, it may result in unexpected attacker-controlled access to the filesystem, in turn potential resulting in arbitrary code execution or credential exfiltration.\n\nSee [**GHSA-w476-p2h3-79g9**](https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9) for how this vulnerability affects `uv`, `astral-tokio-tar`\u0027s primary downstream user. Observe that **unlike** this advisory,` uv`\u0027s advisory is considered **low severity** due to overlap with intentional existing capabilities in source distributions. \n\n## Workarounds\n\nUsers are advised to upgrade to version 0.5.6 or newer to address this advisory.\n\nThere is no workaround other than upgrading.\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| Aug 21, 2025 | Vulnerability discovered by Edera Security Team |\n| Aug 21, 2025 | Initial analysis and PoC confirmed |\n| Aug 22, 2025 | Maintainers notified (privately) |\n| Aug 25, 2025 | Private patch and test suite shared |\n| Oct 7, 2025 | Text freeze for GHSA |\n| Oct 21, 2025 | Coordinated public disclosure and patched releases |\n\n## Credits\n\n- **Discovered by:** Steven Noonan (Edera) and Alex Zenla (Edera)\n- **Coordinated disclosure:** Ann Wallace (Edera)",
  "id": "GHSA-j5gw-2vrg-8fgx",
  "modified": "2026-01-16T22:12:12Z",
  "published": "2025-10-21T15:42:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318"
    },
    {
      "type": "WEB",
      "url": "https://edera.dev/stories/tarmageddon"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/astral-sh/tokio-tar"
    },
    {
      "type": "WEB",
      "url": "https://github.com/edera-dev/cve-tarmageddon"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0110.html"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0111.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "astral-tokio-tar Vulnerable to PAX Header Desynchronization"
}

CVE-2025-62518 (GCVE-0-2025-62518)

Vulnerability from cvelistv5 – Published: 2025-10-21 16:13 – Updated: 2025-10-22 13:23

Title

astral-tokio-tar Vulnerable to PAX Header Desynchronization

Summary

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/astral-sh/tokio-tar/security/a…	x_refsource_CONFIRM
	https://github.com/astral-sh/uv/security/advisori…	x_refsource_MISC
	https://github.com/astral-sh/tokio-tar/commit/22b…	x_refsource_MISC
	https://edera.dev/stories/tarmageddon	x_refsource_MISC
	https://github.com/edera-dev/cve-tarmageddon	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	astral-sh	tokio-tar	Affected: < 0.5.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62518",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-22T13:18:16.414919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-22T13:23:33.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tokio-tar",
          "vendor": "astral-sh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-21T16:13:02.646Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx"
        },
        {
          "name": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9"
        },
        {
          "name": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318"
        },
        {
          "name": "https://edera.dev/stories/tarmageddon",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://edera.dev/stories/tarmageddon"
        },
        {
          "name": "https://github.com/edera-dev/cve-tarmageddon",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/edera-dev/cve-tarmageddon"
        }
      ],
      "source": {
        "advisory": "GHSA-j5gw-2vrg-8fgx",
        "discovery": "UNKNOWN"
      },
      "title": "astral-tokio-tar Vulnerable to PAX Header Desynchronization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62518",
    "datePublished": "2025-10-21T16:13:02.646Z",
    "dateReserved": "2025-10-15T15:03:28.134Z",
    "dateUpdated": "2025-10-22T13:23:33.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

rustsec-2025-0111

Vulnerability from osv_rustsec

GHSA-J5GW-2VRG-8FGX

Summary

Details

Vulnerability Description

Attack Mechanism

Root Cause

Impact

Workarounds

Timeline

Credits

CVE-2025-62518 (GCVE-0-2025-62518)

Tags

Sightings

Nomenclature