GHSA-6gx3-4362-rf54
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6gx3-4362-rf54
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6gx3-4362-rf54/GHSA-6gx3-4362-rf54.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-6gx3-4362-rf54
- Aliases
- Downstream
CGA (10)
MINI (1)
- Published
- 2026-03-17T19:49:35Z
- Modified
- 2026-09-10T03:50:37Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- astral-tokio-tar insufficiently validates PAX extensions during extraction
- Details
-
Impact
In versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by having astral-tokio-tar silently skip a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension.
In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. Consequently this advisory is considered low-severity within astral-tokio-tar itself, as it requires a separate vulnerability against any unrelated tar parser.
Patches
Versions 0.6.0 and newer of astral-tokio-tar reject invalid PAX extensions, rather than silently skipping them.
Workarounds
Users are advised to upgrade to version 0.6.0 or newer to address this advisory.
Most users should experience no breaking changes as a result of the patch above. Some users who attempt to extract poorly constructed tar files may experience errors; users should re-construct their tar files with a conforming tar parser.
Attribution
- Sergei Zimmerman (@xokdvium)
- Database specific
{ "cwe_ids": [ "CWE-436" ], "github_reviewed": true, "github_reviewed_at": "2026-03-17T19:49:35Z", "nvd_published_at": "2026-03-20T00:16:18Z", "severity": "MODERATE" }- References
-
- https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54
- https://nvd.nist.gov/vuln/detail/CVE-2026-32766
- https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52
- https://github.com/astral-sh/tokio-tar
- https://rustsec.org/advisories/RUSTSEC-2026-0066.html
Affected packages
crates.io / astral-tokio-tar
Package
- Name
- astral-tokio-tar
- View open source insights on deps.dev
- Purl
- pkg:cargo/astral-tokio-tar