CVE-2026-33055

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33055
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33055.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33055
Aliases
Downstream
Related
Published
2026-03-20T07:06:08.390Z
Modified
2026-07-15T01:48:54.889416655Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
tar-rs incorrectly ignores PAX size headers if header size is nonzero
Details

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

Database specific 
{
    "cwe_ids": [
        "CWE-843"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33055.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/composefs/tar-rs

Affected ranges

Type
GIT
Repo
https://github.com/composefs/tar-rs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
096e3d16d14fefac51bc4d94d616b21546ea8bcc
Fixed
de1a5870e603758f430073688691165f21a33946
Database specific 
{
    "cpe": "cpe:2.3:a:alexcrichton:tar-rs:*:*:*:*:*:rust:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.4.45"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.11
0.1.6
0.1.8
0.1.9
0.2.1
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.2
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
0.4.1
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.16
0.4.17
0.4.18
0.4.19
0.4.2
0.4.20
0.4.21
0.4.22
0.4.23
0.4.24
0.4.25
0.4.26
0.4.27
0.4.28
0.4.29
0.4.3
0.4.30
0.4.31
0.4.32
0.4.33
0.4.34
0.4.35
0.4.36
0.4.37
0.4.38
0.4.39
0.4.4
0.4.40
0.4.41
0.4.42
0.4.43
0.4.44
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
v0.*
v0.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33055.json"