SB20260409101 - Fedora EPEL 10.0 update for rust-astral-tokio-tar, uv

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260409101

SB20260409101 - Fedora EPEL 10.0 update for rust-astral-tokio-tar, uv

Published: April 9, 2026

Security Bulletin ID SB20260409101
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2025-62518)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause inconsistent extraction behavior.

The vulnerability exists due to improper input validation in tar extraction handling when processing source distribution tar archives containing PAX headers with file size overrides. A remote attacker can provide a specially crafted source distribution to cause inconsistent extraction behavior.

Only source distributions formatted as tar archives are affected.


Remediation

Install update from vendor's website.

References