RUSTSEC-2026-0066
NoneCVSS
—
EPSS
—
Published
Mar 17, 2026
CISA due date
—
The record
Insufficient validation of PAX extensions during extraction
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | astral-tokio-tar | 0 | 0.6.0 |
| crates.io | astral-tokio-tar | 0.0.0-0 | 0.6.0 |
Related vulnerabilities
- CVE-2026-32766 astral-tokio-tar is a tar archive reading/writing library for async Rust. Same vulnerability
- RUSTSEC-2026-0145 PAX Header Desynchronization in astral-tokio-tar Also affects astral-tokio-tar
- RUSTSEC-2026-0113 `unpack_in` can chmod arbitrary directories by following symlinks Also affects astral-tokio-tar
- RUSTSEC-2026-0112 PAX Header Desynchronization in astral-tokio-tar Also affects astral-tokio-tar
- CVE-2025-62518 astral-tokio-tar is a tar archive reading/writing library for async Rust. Also affects astral-tokio-tar