{"id":"RUSTSEC-2025-0111","summary":"`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling","details":"The archive reader incorrectly handles PAX extended headers, when the ustar\nheader incorrectly specifies zero size (`size=000000000000`), while a PAX\nheader specifies a non-zero size, `tokio-tar::Archive` is going to read the\nfile content as tar entry header.\n\nThis can be used by a tar file to present different content to `tokio-tar`\ncompared to other tar reader implementations.\n\nThis bug is also known as `CVE-2025-62518` and `GHSA-j5gw-2vrg-8fgx`, as those\ncrates share a common ancestor codebase.\n\nThe `tokio-tar` crate is archived and no longer maintained, we recommend you\nswitch to an alternative crate such as:\n- [`astral-tokio-tar`](https://crates.io/crates/astral-tokio-tar)","aliases":["CVE-2025-62518","GHSA-j5gw-2vrg-8fgx","RUSTSEC-2025-0110"],"modified":"2026-01-30T01:45:28.250765Z","published":"2025-10-21T12:00:00Z","related":["CVE-2025-62518","GHSA-j5gw-2vrg-8fgx"],"database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tokio-tar"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2025-0111.html"},{"type":"WEB","url":"https://edera.dev/stories/tarmageddon"}],"affected":[{"package":{"name":"tokio-tar","ecosystem":"crates.io","purl":"pkg:cargo/tokio-tar"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":["tokio_tar::Archive::new","tokio_tar::ArchiveBuilder::new"],"arch":[],"os":[]}},"database_specific":{"categories":["format-injection"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0111.json"}}],"schema_version":"1.7.3"}