Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-17 | 1 | General1 |
| 2026-02-18 | 1 | General1 |
| 2026-02-24 | 1 | Disclosure1 |
| 2026-03-18 | 1 | Disclosure1 |
| 2026-05-06 | 1 | Disclosure1 |
| 2026-07-26 | 1 | Patch1 |
TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware #TARmageddon #CVE202562518 #OpenSourceSecurity #Abandonware #RCEVulnerability https://edera.dev/stories/tarmageddon
Post summary
A new RCE vulnerability (CVE-2025-62518) in an abandoned open‑source project has been disclosed, underscoring the risks associated with unmaintained software.
@nksages @Franc0Fernand0 No, Also rust doesn't do memory safty much better. Cause the hard parts are validation, race conditions, concurrenty, state control and rust has proven it can't deal with this either. Example: https://nvd.nist.gov/vuln/detail/CVE-2025-62518
Post summary
The tweet merely comments that Rust does not fully address memory safety issues and links to the NVD entry for CVE-2025-62518, without providing additional details or claims.
tokio-tar: 5M+ downloads. Zero maintainers. CVE-2025-62518 will never be patched. Every traditional health metric said the library was alive. It wasn't. My new peer-reviewed paper on measuring end-of-life risk before it becomes an incident: https://www.linkedin.com/posts/sdemian_cybersecurity-supplychainsecurity-opensource-share-7487206903165513730-U8Aw/ https://t.co/1eerdg44rN
Post summary
The post highlights that the unmaintained tokio-tar library, which has CVE‑2025‑62518, will never receive a patch, underscoring the end‑of‑life risk of using this component.
🔴 astral-tokio-tar, PAX Header Desynchronization, #CVE-2025-62518 (High) https://dailycve.com/astral-tokio-tar-pax-header-desynchronization-cve-2025-62518-high-2/
Post summary
The text announces a high‑severity CVE‑2025‑62518 involving a PAX header desynchronization flaw in astral-tokio-tar, with a link for further details.
🔴 astral-tokio-tar, PAX Header Desynchronization, #CVE-2025-62518 (HIGH) https://dailycve.com/astral-tokio-tar-pax-header-desynchronization-cve-2025-62518-high/
Post summary
The tweet announces the disclosure of CVE‑2025‑62518, a high‑severity PAX header desynchronization flaw in astral‑tokio‑tar, with a link to a detailed article.
@JustDeezGuy Rust doesn't solve the problems you think it solves.... https://nvd.nist.gov/vuln/detail/CVE-2025-62518
Post summary
The tweet only links to the NVD entry for CVE-2025-62518 without providing additional context or details.