GHSA-6gx3-4362-rf54 CVE-2026-32766 RUSTSEC-2026-0066
astral-tokio-tar insufficiently validates PAX extensions during extraction
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.25%
- Chance of exploitation in the next 30 days. Higher than 16.85% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-436 Interpretation Conflict
- Fix
0.6.0- Upgrade astral-tokio-tar to this version or later
Description
Impact
In versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by having astral-tokio-tar silently skip a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension.
In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. Consequently this advisory is considered low-severity within astral-tokio-tar itself, as it requires a separate vulnerability against any unrelated tar parser.
Patches
Versions 0.6.0 and newer of astral-tokio-tar reject invalid PAX extensions, rather than silently skipping them.
Workarounds
Users are advised to upgrade to version 0.6.0 or newer to address this advisory.
Most users should experience no breaking changes as a result of the patch above. Some users who attempt to extract poorly constructed tar files may experience errors; users should re-construct their tar files with a conforming tar parser.
Attribution
- Sergei Zimmerman (@xokdvium)
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| astral-tokio-tar | < 0.6.0 |
0.6.0 |
| astral-tokio-tar | >= 0.0.0-0, < 0.6.0 |
0.6.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
astral-tokio-tar crates.io → 0.6.0
- cargo
cargo update -p astral-tokio-tar --precise 0.6.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-3cv2-h65g-fgmm astral-tokio-tar has a PAX Header Desynchronization issue | Medium | Also affects astral-tokio-tar |
| GHSA-fp55-jw48-c537 astral-tokio-tar is Vulnerable to PAX Header Desynchronization | Medium | Also affects astral-tokio-tar |
| GHSA-xx64-wwv2-hcqq astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks | Low | Also affects astral-tokio-tar |
| GHSA-j5gw-2vrg-8fgx astral-tokio-tar Vulnerable to PAX Header Desynchronization | High | Also affects astral-tokio-tar |
| GHSA-3wgq-wrwc-vqmv astral-tokio-tar has a path traversal in tar extraction | Medium | Also affects astral-tokio-tar |
| GHSA-5x38-2vff-x55p Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 | High | Same weakness, CWE-436 |
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes | Medium | Same weakness, CWE-436 |
| GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass | Medium | Same weakness, CWE-436 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor