RUSTSEC-2026-0112

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0112

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0112.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0112

Aliases

GHSA-fp55-jw48-c537

Published

2026-04-27T12:00:00Z

Modified

2026-04-28T13:30:15.618809Z

Summary

PAX Header Desynchronization in astral-tokio-tar

Details

Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / astral-tokio-tar

Package

Name: astral-tokio-tar; View open source insights on deps.dev
Purl: pkg:cargo/astral-tokio-tar

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.6.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "os": [],
        "functions": []
    }
}

Database specific

informational

null