RUSTSEC-2026-0068
NoneCVSS
—
EPSS
—
Published
Mar 19, 2026
CISA due date
—
The record
tar-rs incorrectly ignores PAX size headers if header size is nonzero
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | tar | 0 | 0.4.45 |
| crates.io | tar | 0.0.0-0 | 0.4.45 |
Related vulnerabilities
- CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Same vulnerability
- GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue Also affects tar
- CVE-2026-33056 tar-rs is a tar archive reading/writing library for Rust. Also affects tar
- RUSTSEC-2026-0067 `unpack_in` can chmod arbitrary directories by following symlinks Also affects tar