CVE-2025-62518: 
Rust vulnerability analysis and mitigation

CVE-2025-62518, dubbed TARmageddon, is a high-severity boundary parsing vulnerability discovered in August 2025 affecting the astral-tokio-tar Rust library and its forks. The vulnerability allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling in versions prior to 0.5.6. The flaw impacts several widely-used projects, including testcontainers and wasmCloud (Hacker News, GitHub Advisory).

The vulnerability stems from inconsistent handling of PAX extended headers versus ustar headers when determining file data boundaries. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. The vulnerability has a CVSS score of 8.1 (High) and is classified under CWE-843 (Type Confusion) (GitHub Advisory, Edera Blog).

In the worst-case scenario, this vulnerability can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends. The impact is particularly severe when the library is used to extract untrusted tar archives, potentially resulting in unexpected attacker-controlled access to the filesystem and credential exfiltration (GitHub Advisory, Hacker News).

The vulnerability can be exploited by crafting a malicious TAR file containing PAX headers with file size overrides where the PAX header correctly specifies the actual file size while the ustar header incorrectly specifies zero size. This mismatch creates a parsing inconsistency that allows attackers to smuggle additional archives when the library processes nested TAR files (Edera Blog, GitHub Advisory).

Users are advised to upgrade to astral-tokio-tar version 0.5.6 or newer, which includes the patch for this vulnerability. There are no workarounds other than upgrading. The fix involves modifying the TAR parser to prioritize PAX headers for size determination over ustar headers and implementing strict boundary checking to prevent data/header confusion (GitHub Advisory).

The security community has noted that while Rust's guarantees make it significantly harder to introduce memory safety bugs, it does not eliminate logic bugs, and this parsing inconsistency is fundamentally a logic flaw. The problem is compounded by the fact that tokio-tar is essentially abandonware despite attracting thousands of downloads via crates.io (Hacker News, Edera Blog).