{"id":"CVE-2026-32766","aliases":["DEBIAN-CVE-2026-32766","EUVD-2026-13414","GHSA-6gx3-4362-rf54","RUSTSEC-2026-0066","SUSE-SU-2026:22005-1","UBUNTU-CVE-2026-32766","openSUSE-SU-2026:20865-1"],"status":"published","title":"astral-tokio-tar insufficiently validates PAX extensions during extraction","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","severity":{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00259,"percentile":0.17693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-03-17T12:00:00Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"crates.io","package":"astral-tokio-tar","fixed_in":["0.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"rust-astral-tokio-tar","fixed_in":["0.6.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.5.6"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2-2","0.5.5-1","0.5.6-1","0.5.6-2","0.6.0-1","0.6.1-1","0.6.2-1","0.6.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-1"}]}],"versions":["0.5.2-2","0.5.5-1","0.5.6-1","0.5.6-2"]},{"source":"osv","ecosystem":"crates.io","package":"astral-tokio-tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"astral-tokio-tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-160000.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.1-1","0.5.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.6-2","0.6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2-2","0.5.5-1","0.5.6-1","0.5.6-2"]}],"products":[{"vendor":"astral","product":"astral-tokio-tar"},{"vendor":"astral-sh","product":"tokio-tar"}],"references":[{"url":"https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32766","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0066.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6gx3-4362-rf54"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32766.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32766","tags":["advisory"]},{"url":"https://github.com/astral-sh/tokio-tar","tags":["package"]},{"url":"https://crates.io/crates/astral-tokio-tar","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622005-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259624","tags":["report"]},{"url":"https://bugzilla.suse.com/1259966","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32766","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-32766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32766","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32766","title":"astral-tokio-tar insufficiently validates PAX extensions during extraction","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-20T00:07:36.444Z","modified":"2026-03-20T18:09:06.34Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-13414","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-20T00:07:36Z","modified":"2026-03-20T18:09:06Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T19:25:32.04432Z"}],"ghsa":[{"id":"GHSA-6gx3-4362-rf54","title":"astral-tokio-tar insufficiently validates PAX extensions during extraction","description":"## Impact\n\nIn versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by having astral-tokio-tar silently skip a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension.\n\nIn practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. Consequently this advisory is considered low-severity within astral-tokio-tar itself, as it requires a separate vulnerability against any unrelated tar parser.\n\n## Patches\n\nVersions 0.6.0 and newer of astral-tokio-tar reject invalid PAX extensions, rather than silently skipping them. \n\n## Workarounds\n\nUsers are advised to upgrade to version 0.6.0 or newer to address this advisory.\n\nMost users should experience no breaking changes as a result of the patch above. Some users who attempt to extract poorly constructed tar files may experience errors; users should re-construct their tar files with a conforming tar parser.\n\n## Attribution\n\n- Sergei Zimmerman (@xokdvium)","status":"published","published":"2026-03-17T19:49:35Z","modified":"2026-04-24T20:45:41Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:39:57.650091Z"}],"nvd":[{"id":"CVE-2026-32766","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-20T00:16:18.1Z","modified":"2026-06-17T10:36:20.847Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-32766","title":"astral-tokio-tar insufficiently validates PAX extensions during extraction","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-20T00:07:36.444Z","modified":"2026-10-28T02:30:39.28456279Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-32766","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-20T00:16:18.1Z","modified":"2026-10-01T03:03:03.504753555Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"GHSA-6gx3-4362-rf54","title":"astral-tokio-tar insufficiently validates PAX extensions during extraction","description":"## Impact\n\nIn versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by having astral-tokio-tar silently skip a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension.\n\nIn practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. Consequently this advisory is considered low-severity within astral-tokio-tar itself, as it requires a separate vulnerability against any unrelated tar parser.\n\n## Patches\n\nVersions 0.6.0 and newer of astral-tokio-tar reject invalid PAX extensions, rather than silently skipping them. \n\n## Workarounds\n\nUsers are advised to upgrade to version 0.6.0 or newer to address this advisory.\n\nMost users should experience no breaking changes as a result of the patch above. Some users who attempt to extract poorly constructed tar files may experience errors; users should re-construct their tar files with a conforming tar parser.\n\n## Attribution\n\n- Sergei Zimmerman (@xokdvium)","status":"published","published":"2026-03-17T19:49:35Z","modified":"2026-09-10T03:50:37.790948185Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"RUSTSEC-2026-0066","title":"Insufficient validation of PAX extensions during extraction","description":"In versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions\nwere silently skipped when parsing tar archives. This silent skipping (rather\nthan rejection) of invalid PAX extensions could be used as a building block for\na parser differential, for example by silently skipping a malformed GNU \"long\nlink\" extension so that a subsequent parser would misinterpret the extension.\n\nIn practice, exploiting this behavior in astral-tokio-tar requires a secondary\nmisbehaving tar parser, i.e. one that insufficiently validates malformed PAX\nextensions and interprets them rather than skipping or erroring on them. This\nvulnerability is considered low-severity as it requires a separate\nvulnerability against any unrelated tar parser.\n\nThis issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-17T12:00:00Z","modified":"2026-03-23T09:56:17.487066Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-32766","description":"astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.","status":"published","published":"2026-03-20T00:16:00Z","modified":"2026-10-17T12:58:10.045886704Z","cvss":[{"version":"4.0","score":1.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"openSUSE-SU-2026:20865-1","title":"Security update for python-uv","description":"This update for python-uv fixes the following issues:\n\n- CVE-2026-31812: quinn-proto: denial of service via crafted QUIC initial packet (bsc#1259624).\n- CVE-2026-32766: astral-tokio-tar: malformed PAX extensions can lead to archive misinterpretation (bsc#1259966).\n","status":"published","published":"2026-06-01T15:03:55Z","modified":"2026-06-04T18:24:27.457193418Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22005-1","title":"Security update for python-uv","description":"This update for python-uv fixes the following issues:\n\n- CVE-2026-31812: quinn-proto: denial of service via crafted QUIC initial packet (bsc#1259624).\n- CVE-2026-32766: astral-tokio-tar: malformed PAX extensions can lead to archive misinterpretation (bsc#1259966).\n","status":"published","published":"2026-06-01T15:05:25Z","modified":"2026-06-09T18:24:27.417007029Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}