GHSA-fp55-jw48-c537
astral-tokio-tar is Vulnerable to PAX Header Desynchronization
Impact
Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.
Patches
Versions 0.6.1 and newer of astral-tokio-tar address this differential.
Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
There is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.
Resources
- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug
Attribution
- Reporter: Adam Harvey (@lawngnome)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score used
astral-tokio-tar is Vulnerable to PAX Header Desynchronization
Impact
Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.
Patches
Versions 0.6.1 and newer of astral-tokio-tar address this differential.
Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
There is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.
Resources
- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug
Attribution
- Reporter: Adam Harvey (@lawngnome)
- Record
GHSA-fp55-jw48-c537- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-20, CWE-843
- Updated
- 2026-11-02
OSV
astral-tokio-tar is Vulnerable to PAX Header Desynchronization
Impact
Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.
Patches
Versions 0.6.1 and newer of astral-tokio-tar address this differential.
Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
There is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.
Resources
- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug
Attribution
- Reporter: Adam Harvey (@lawngnome)
- Record
GHSA-fp55-jw48-c537- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-20, CWE-843
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0112No score
PAX Header Desynchronization in astral-tokio-tar
Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
- Record
RUSTSEC-2026-0112- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
astral-tokio-tarcrates.io | through 0.6.0 | 0.6.1 |
astral-tokio-tarcrates.io | before 0.6.1 | 0.6.1 |
astral-tokio-tarcrates.io | 0.0.0-0 up to 0.6.1 | 0.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-fp55-jw48-c537 is a medium vulnerability (CVSS 6.6) in astral-tokio-tar, published April 27, 2026. No source lists public exploit code. Fixed in astral-tokio-tar 0.6.1.