RUSTSEC-2026-0145
NoneCVSS
—
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
PAX Header Desynchronization in astral-tokio-tar
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | astral-tokio-tar | 0 | 0.6.2 |
| crates.io | astral-tokio-tar | 0.0.0-0 | 0.6.2 |
Related vulnerabilities
- RUSTSEC-2026-0113 `unpack_in` can chmod arbitrary directories by following symlinks Also affects astral-tokio-tar
- RUSTSEC-2026-0112 PAX Header Desynchronization in astral-tokio-tar Also affects astral-tokio-tar
- CVE-2026-32766 astral-tokio-tar is a tar archive reading/writing library for async Rust. Also affects astral-tokio-tar
- RUSTSEC-2026-0066 Insufficient validation of PAX extensions during extraction Also affects astral-tokio-tar
- CVE-2025-62518 astral-tokio-tar is a tar archive reading/writing library for async Rust. Also affects astral-tokio-tar