Description
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| astral-sh | tokio-tar | < 0.5.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-astral-tokio-tar | 0.5.6-1 | — |
| Debian 13 | rust-astral-tokio-tar | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | rust-astral-tokio-tar | No fix yet | — |
| Ubuntu 25.10 | rust-astral-tokio-tar | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-uv | 0.7.18-160000.3.1 | SUSE-SU-2026:20077-1 |
| SLES 16.0 | python-uv | 0.7.18-160000.3.1 | SUSE-SU-2026:20077-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-uv | 0.9.5-1.1 | openSUSE-SU-2025:15658-1 |
| openSUSE Tumbleweed | zed | 1.24.2-1.1 | openSUSE-SU-2026:12355-1 |
| openSUSE Leap 16.0 | python-uv | 0.7.18-160000.3.1 | openSUSE-SU-2026:20026-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | pixi +1 | 0.57.0-r1 | — |
| Wolfi rolling | wash | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
edera-dev/cve-tarmageddon ★ 19 · Aug 21, 2025
CVE-2025-62518: TARmageddon
-
AirineiAndrei/Tarmageddon-CVE-2025-62518- ★ 0 · Jan 19, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | astral-tokio-tar | < 0.5.6 | 0.5.6 | GHSA-j5gw-2vrg-8fgx |
| crates.io | astral-tokio-tar | >= 0.0.0-0, < 0.5.6 | 0.5.6 | RUSTSEC-2025-0110 |
| crates.io | tokio-tar | <= 0.3.1 | — | GHSA-j5gw-2vrg-8fgx |
| crates.io | tokio-tar | >= 0.0.0-0 | — | RUSTSEC-2025-0111 |
Advisories 4
- openSUSE-SU-2026:12355-1 zed-1.24.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
- openSUSE-SU-2026:20026-1 Security update for python-uv SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15658-1 python311-uv-0.9.5-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20077-1 Security update for python-uv SUSE / openSUSE Security Updates · Mar 23, 2026
References
- https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-j5gw-2vrg-8fgx
- https://github.com/astral-sh/uv/security/advisories/GHSA-w476-p2h3-79g9
- https://github.com/astral-sh/tokio-tar/commit/22b3f884adb7a2adf1d3a8d03469533f5cbc8318
- https://edera.dev/stories/tarmageddon
- https://github.com/edera-dev/cve-tarmageddon