CVE-2025-62518

Published Oct 21, 2025

Last updated 5 months ago

CVSS high 8.1
TARmageddon
astral-tokio-tar

Overview

Description
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
Source
security-advisories@github.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.1
Impact score
5.2
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity
HIGH

Weaknesses

security-advisories@github.com
CWE-843

Social media

Hype score
Not currently trending
  1. TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware #TARmageddon #CVE202562518 #OpenSourceSecurity #Abandonware #RCEVulnerability https://t.co/6VslkpQhEm

    @reverseame

    24 Feb 2026

    1375 Impressions

    7 Retweets

    16 Likes

    9 Bookmarks

    0 Replies

    0 Quotes

  2. 🪤 TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware 「 Due to the widespread nature of tokio-tar in various forms, it is not possible to truly quantify upfront the blast radius of this bug across the ecosystem 」

    @jbzfn

    12 Nov 2025

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. Cloud & Cybersecurity Weekly: AWS launches RTB Fabric for ad-tech, but a DNS outage hit Alexa & Fortnite. Critical Rust flaws (CVE-2025-62518) & TP-Link router bugs need urgent patches. CISOs: AI speeds attacks—boost resilience now. #Cybersecurity #CloudTech #AWS

    @cageyvdev

    9 Nov 2025

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🛠️ TARmageddon (CVE-2025-62518) A critical boundary-parsing bug, TARmageddon (CVE-2025-62518), in the async-tar Rust library and its forks, including tokio-tar. This vulnerability, with a severity of 8.1 (High), can enable Remote Code Execution (RCE) through file overwrit

    @IntCyberDigest

    3 Nov 2025

    2038 Impressions

    5 Retweets

    17 Likes

    5 Bookmarks

    0 Replies

    0 Quotes

  5. 🚨🔍 **Security Alert!** Edera found a critical bug, TARmageddon (CVE-2025-62518), in async-tar. Risks RCE! 📉 Upgrade or remove dependencies! For tokio-tar, switch to #astral-tokio-tar. Stay safe! 🛡️https://t.co/K6XaAOYpTY✨ #RustLang #SecurityPatch https://t.co/emUY

    @ReliableEmbSys

    1 Nov 2025

    75 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. ⚠️Vulnerabilidad en Rust ❗CVE-2025-62518 ➡️Más info: https://t.co/chagZYCUOT https://t.co/EjOXWmHPga

    @CERTpy

    28 Oct 2025

    75 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 **TARmageddon: KERENTANAN KEAMANAN PARAH DI LIBRARY RUST POPULER – SKOR CVSS 8.1!** 🚨 Ancaman baru buat developer Rust! Kerentanan high-profile ini bisa bikin sistem crash total atau eksekusi kode jahat. Disebut TARmageddon (CVE-2025-62518), ditemukan di library populer

    @BJORKANISM_REAL

    25 Oct 2025

    46 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Tarmageddon 🦀(CVE-2025-62518): RCE vulnerability highlights the challenges of open source abandonware https://t.co/GjV7xbDUHL

    @jedisct1

    25 Oct 2025

    879 Impressions

    0 Retweets

    2 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  9. 🚨TARmageddon: High Profile Security Vulnerability In Popular Rust Library CVE: CVE-2025-62518 CVSS: 8.1 GitHub: https://t.co/kR7MJjO2s4 Write-up: https://t.co/dzwaSoh9xh https://t.co/VGM25CXF3A

    @DarkWebInformer

    25 Oct 2025

    5156 Impressions

    5 Retweets

    18 Likes

    5 Bookmarks

    0 Replies

    0 Quotes

  10. TARMAGEDDON (CVE-2025-62518): RCE Vulnerability Highlights the challenges of open source abandonware https://t.co/J4PSxQ4e3x

    @_r_netsec

    24 Oct 2025

    2769 Impressions

    5 Retweets

    14 Likes

    6 Bookmarks

    0 Replies

    1 Quote

  11. Ready for a new Branded Vulnerability™? #TARmageddon (CVE-2025-62518) affects the #Rust ecosystem's may forks of `async-tar`; it's a parsing bug for the .tar file format that allows all kinds of shenanigans: at worst even #RCE (Remote Code Execution). Fortunately for us, it's a

    @CheckmarxZero

    23 Oct 2025

    76 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  12. TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware https://t.co/C8MfgTuKR0 #appsec

    @eyalestrin

    23 Oct 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. #CVE-2025-62518 is a high-severity remote code execution vulnerability in async-tar Rust library, impacting tools like uv and tokio-tar. Address the issue by auditing and patching dependencies to prevent risks from abandoned open-source code. #CyberSecurity #PatchManagement

    @bigmacd16684

    23 Oct 2025

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Cybersecurity researchers have disclosed details of a high-severity flaw (CVE-2025-62518) impacting the popular async-tar Rust library and its forks. #CyberSecurity #InfoSec https://t.co/ohEe3yFI9N https://t.co/HJbeD4zqdj

    @twelvesec

    23 Oct 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. TARmageddon – Kritikus biztonsági sérülékenység a népszerű Rust programkönyvtárban Ezen a héten vált nyilvánossá a CVE-2025-62518, közismert nevén TARmageddon, egy súlyos biztonsági sérülékenység a népszerű async-tar Rust könyvtárban és annak forkjaib

    @linuxmint_hun

    23 Oct 2025

    31 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. Edera disclosed the TARmageddon flaw (CVE-2025-62518) in the Rust async-tar library, allowing remote code execution by exploiting mismatched PAX/ustar headers, posing serious supply-chain risks. #Rust #CyberSecurity https://t.co/vunyZ3OTUB

    @Cyber_O51NT

    23 Oct 2025

    193 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  17. TARmageddon (CVE-2025-62518) was discovered in August 2025 being used in Tar based projects such as testcontainers and wasmCloud. With a CVSS score of 8.1, with the assumption malware can be written to create a RCE to overwrite files, or hijacking build back-ends. By advancing 0

    @Leila97726926

    22 Oct 2025

    44 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  18. 🚨 'TARmageddon' flaw (CVE-2025-62518) in async-tar Rust library & forks allows RCE. High-severity warning for developers! https://t.co/gJPBDsAfMy #RustLang #Cybersecurity #RCE #Vulnerability #TARmageddon

    @0xT3chn0m4nc3r

    22 Oct 2025

    8 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. 📌 كشف باحثو الأمن السيبراني عن ثغرة خطيرة في مكتبة async-tar بلغة Rust، قد تؤدي إلى تنفيذ رموز عن بُعد. تم تصنيف الثغرة برمز CVE-2025-62518، وسجلها 8.1، وأطلق عليها اسم T

    @Cybercachear

    22 Oct 2025

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. #snapchatleak  #crypto        $ #easymoney   #purchasesnaphack #explore #Everyone It’s called TARmageddon (CVE-2025-62518) — a flaw in the async-tar library that lets attackers slip hidden files inside nested TAR archives. https://t.co/jG0rH3JmBv

    @silentwolf12347

    22 Oct 2025

    30 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  21. A tiny Rust bug just broke thousands of builds. It’s called TARmageddon (CVE-2025-62518) — a flaw in the async-tar library that lets attackers slip hidden files inside nested TAR archives. Unpatched since 2023, developers are now racing to fix it ↓ https://t.co/h1VeKfz2Mg

    @TheHackersNews

    22 Oct 2025

    10694 Impressions

    21 Retweets

    43 Likes

    8 Bookmarks

    0 Replies

    4 Quotes

  22. Rust Library Flaw Exposes Systems to Remote Code Execution Edera researchers disclosed a high-severity CVE-2025-62518 vulnerability (CVSS 8.1) in an abandoned Rust async tar library affecting many forks, including tokio-tar with 5M+ downloads. Exploitation could enable remote ht

    @Secwiserapp

    21 Oct 2025

    37 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. **CVE-2025-62518** pertains to a boundary parsing flaw in the `astral-tokio-tar` library, a Rust-based asynchronous tar archive processing library. Specifically, the vulnerability exists in versions prior to 0.5.6 and involves improper handling of archive headers, especially when

    @CveTodo

    21 Oct 2025

    20 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. CVE-2025-62518 astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that al… https://t.co/mYAi9BvWqa

    @CVEnew

    21 Oct 2025

    206 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes