astral-tokio-tar has 4 CVEs on record between 2025 and 2026. The median CVSS is 8.1 (high).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 0 prev 3
Weakness classes
Products
- astral-tokio-tar 4
4
Total CVEs
0
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2025-62518High· 8.1astral-tokio-tar is a tar archive reading/writing library for async Rust57RUSTSEC-2026-0145NonePAX Header Desynchronization in astral-tokio-tar3RUSTSEC-2026-0113None`unpack_in` can chmod arbitrary directories by following symlinks3RUSTSEC-2026-0112NonePAX Header Desynchronization in astral-tokio-tar3
astral-tokio-tar vulnerabilities
CVEs affecting astral-tokio-tar, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
RUSTSEC-2026-0145NonePAX Header Desynchronization in astral-tokio-tar
PAX Header Desynchronization in astral-tokio-tar
▾ Sunlitastral-tokio-tar · astral-tokio-tarvia OSV
RUSTSEC-2026-0113None`unpack_in` can chmod arbitrary directories by following symlinks
`unpack_in` can chmod arbitrary directories by following symlinks
▾ Sunlitastral-tokio-tar · astral-tokio-tarvia OSV
RUSTSEC-2026-0112NonePAX Header Desynchronization in astral-tokio-tar
PAX Header Desynchronization in astral-tokio-tar
▾ Sunlitastral-tokio-tar · astral-tokio-tarvia OSV
CVE-2025-62518High· 8.1PoCastral-tokio-tar is a tar archive reading/writing library for async Rust
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inco…
▾ Midnightastral-tokio-tar · astral-tokio-tarEPSS 0.70%via NVD