{"id":"GHSA-fp55-jw48-c537","aliases":["RUSTSEC-2026-0112"],"status":"published","title":"astral-tokio-tar is Vulnerable to PAX Header Desynchronization","description":"### Impact\n\nVersions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.\n\nSee GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.\n\n### Patches\n\nVersions 0.6.1 and newer of astral-tokio-tar address this differential.\n\n### Workarounds\n\nUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.\n\nThere is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.\n\n### Resources\n\n- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug\n\n### Attribution\n\n- Reporter: Adam Harvey (@lawngnome)","severity":{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-843"],"published":"2026-04-27T12:00:00Z","modified":"2026-10-12T18:00:08Z","fixes":[{"ecosystem":"crates.io","package":"astral-tokio-tar","fixed_in":["0.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.6.0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"astral-tokio-tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"astral-tokio-tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.1"}]}]}],"references":[{"url":"https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-fp55-jw48-c537","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fp55-jw48-c537","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0112.html","tags":["web","advisory"]},{"url":"https://github.com/astral-sh/tokio-tar","tags":["package"]},{"url":"https://crates.io/crates/astral-tokio-tar","tags":["package"]},{"url":"https://github.com/astral-sh/tokio-tar/commit/6f4f9ebc180f4d39d66d9c584a3796c0b9ae34c1","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-fp55-jw48-c537","title":"astral-tokio-tar is Vulnerable to PAX Header Desynchronization","description":"### Impact\n\nVersions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.\n\nSee GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.\n\n### Patches\n\nVersions 0.6.1 and newer of astral-tokio-tar address this differential.\n\n### Workarounds\n\nUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.\n\nThere is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.\n\n### Resources\n\n- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug\n\n### Attribution\n\n- Reporter: Adam Harvey (@lawngnome)","status":"published","published":"2026-05-06T17:26:12Z","modified":"2026-05-06T17:26:13Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-20","CWE-843"],"updated_at":"2026-11-02T14:40:01.917039Z"}],"osv":[{"id":"GHSA-fp55-jw48-c537","title":"astral-tokio-tar is Vulnerable to PAX Header Desynchronization","description":"### Impact\n\nVersions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.\n\nSee GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.\n\n### Patches\n\nVersions 0.6.1 and newer of astral-tokio-tar address this differential.\n\n### Workarounds\n\nUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.\n\nThere is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.\n\n### Resources\n\n- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug\n\n### Attribution\n\n- Reporter: Adam Harvey (@lawngnome)","status":"published","published":"2026-05-06T17:26:12Z","modified":"2026-09-10T03:50:46.705838044Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-20","CWE-843"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"RUSTSEC-2026-0112","title":"PAX Header Desynchronization in astral-tokio-tar","description":"Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation\nbug that allows manipulated entries to be made selectively visible or invisible\nduring extraction with astral-tokio-tar versus other tar implementations.\nAn attacker could use this differential to smuggle unexpected files onto a\nvictim's filesystem.","status":"published","published":"2026-04-27T12:00:00Z","modified":"2026-10-12T18:00:08.226377588Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}