Vulnerability RUSTSEC-2026-0112
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 months ago
April 27, 2026 at 12:00 PM UTC
PAX Header Desynchronization in astral-tokio-tar
0.5.0 - 0.6.1-rc1
0.5.0 - 0.6.1-rc1
Summary
PAX Header Desynchronization in astral-tokio-tar
Details
Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
2 days ago
`astral-tokio-tar` is unmaintained
0.5.0 - 0.7.1 RUSTSEC-2026-0440
0.5.0 - 0.7.1 RUSTSEC-2026-0440
Medium Risk
5 months ago
astral-tokio-tar has a PAX Header Desynchronization issue
0.5.0 - 0.6.1 GHSA-3cv2-h65g-fgmm
0.5.0 - 0.6.1 GHSA-3cv2-h65g-fgmm
Unknown
5 months ago
PAX Header Desynchronization in astral-tokio-tar
0.5.0 - 0.6.1 RUSTSEC-2026-0145
0.5.0 - 0.6.1 RUSTSEC-2026-0145
Low Risk
6 months ago
astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
0.5.0 - 0.6.1-rc1 GHSA-xx64-wwv2-hcqq
0.5.0 - 0.6.1-rc1 GHSA-xx64-wwv2-hcqq
Medium Risk
6 months ago
astral-tokio-tar is Vulnerable to PAX Header Desynchronization
0.5.0 - 0.6.1-rc1 GHSA-fp55-jw48-c537
0.5.0 - 0.6.1-rc1 GHSA-fp55-jw48-c537
Impacted packages
Timeline
Published
6 months ago
April 27, 2026 at 12:00 PM UTC
Fixed (0.6.1)
6 months ago
April 27, 2026 at 06:22 PM UTC
Last Modified
23 days ago
October 12, 2026 at 06:00 PM UTC