CVE catalog

CVE-2025-62518

python311-uv-0.9.5-1.1 on GA media

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.70% · Oct 25, 2026

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-astral-tokio-tar130.5.2-2vulnerable
Debianrust-astral-tokio-tar130.5.5-1vulnerable
Debianrust-astral-tokio-tar130.5.6-1vulnerable
Debianrust-astral-tokio-tar130.5.6-2vulnerable
Debianrust-astral-tokio-tar130.6.0-1vulnerable
Debianrust-astral-tokio-tar130.6.1-1vulnerable
Debianrust-astral-tokio-tar130.6.2-1vulnerable
Debianrust-astral-tokio-tar130.6.4-1vulnerable
Debianrust-astral-tokio-tar140.5.2-2vulnerable
Debianrust-astral-tokio-tar140.5.5-1vulnerable
Debianrust-astral-tokio-tar140.5.6-1fixed
Ubunturust-astral-tokio-tar25.100.5.1-1vulnerable
Ubunturust-astral-tokio-tar25.100.5.2-2vulnerable
Ubunturust-astral-tokio-tar26.040.5.2-2vulnerable
Ubunturust-astral-tokio-tar26.040.5.5-1vulnerable
Ubunturust-astral-tokio-tar26.040.5.6-1vulnerable
Ubunturust-astral-tokio-tar26.040.5.6-2vulnerable
Opensusepython-uvtumbleweed0.9.5-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-astral-tokio-tardeb140.5.6-1Not reportedDEBIAN-CVE-2025-62518Not reported
Opensusepython-uvrpmtumbleweed0.9.5-1.1Not reportedOPENSUSE-SU-2025:15658-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [librust-astral-tokio-tar-dev]Affected

    Source package: [rust-astral-tokio-tar]

    Details (2)

    • 0.5.2-2 · amd64 · trixie

      Affected

      pypi · rust-astral-tokio-tar · debian · 13

    • 0.5.2-2 · arm64 · trixie

      Affected

      pypi · rust-astral-tokio-tar · debian · 13

[openSUSE Tumbleweed]

  • [python313-uv]Unknown

    Source package: [python-uv]

    Details (1)

    • 0.12.7-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.9.5-1.1

      Version impact unknown

      pypi · python-uv · opensuse · tumbleweed

  • [python314-uv]Unknown

    Source package: [python-uv]

    Details (1)

    • 0.12.7-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 0.9.5-1.1

      Version impact unknown

      pypi · python-uv · opensuse · tumbleweed

  • [uv-bash-completion]Unknown

    Source package: [python-uv]

    Details (1)

    • 0.12.7-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.9.5-1.1

      Version impact unknown

      pypi · python-uv · opensuse · tumbleweed

  • [uv-fish-completion]Unknown

    Source package: [python-uv]

    Details (1)

    • 0.12.7-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.9.5-1.1

      Version impact unknown

      pypi · python-uv · opensuse · tumbleweed

  • [uv-zsh-completion]Unknown

    Source package: [python-uv]

    Details (1)

    • 0.12.7-1.1 · noarch · tumbleweed

      Unknown · Fixed: 0.9.5-1.1

      Version impact unknown

      pypi · python-uv · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]