Executive brief
astral-tokio-tar Vulnerable to PAX Header Desynchronization
Affected products
- crates.io astral-tokio-tar
- crates.io tokio-tar
Junglewise Threat Intelligence
CVE-2025-62518: RUSTSEC-2025-0110 - astral-tokio-tar Vulnerable to PAX Header Desynchronization
CVE-2025-62518 · Severity: low · CVSS 3.1 · Published 2025-10-21
Technologies: astral-tokio-tar (crates.io). Vendors: crates.io.
Related threats
- astral-tokio-tar has a PAX Header Desynchronization issue
- Astral astral-tokio-tar PAX header desynchronization
- RUSTSEC-2026-0145 - PAX Header Desynchronization in astral-tokio-tar
- astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
- astral-tokio-tar is Vulnerable to PAX Header Desynchronization