RUSTSEC-2025-0111

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0111

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0111.json

JSON Data

https://api.test.osv.dev/v1/vulns/RUSTSEC-2025-0111

Related

Published

2025-10-21T12:00:00Z

Modified

2025-10-25T11:18:52Z

Summary

`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling

Details

The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size (size=000000000000), while a PAX header specifies a non-zero size, tokio-tar::Archive is going to read the file content as tar entry header.

This can be used by a tar file to present different content to tokio-tar compared to other tar reader implementations.

This bug is also known as CVE-2025-62518 and GHSA-j5gw-2vrg-8fgx, as those crates share a common ancestor codebase.

The tokio-tar crate is archived and no longer maintained, we recommend you switch to an alternative crate such as: - <code>astral-tokio-tar</code>

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tokio-tar

Package

Name: tokio-tar; View open source insights on deps.dev
Purl: pkg:cargo/tokio-tar

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "functions": [
            "tokio_tar::Archive::new",
            "tokio_tar::ArchiveBuilder::new"
        ],
        "os": [],
        "arch": []
    }
}

Database specific

informational

null

cvss

null