https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:38:37.815655+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-33055 BELL-CVE-2026-33055 2026-10-03T10:38:37.822917+00:00

Affected: Alpaquita:23: rust, Alpaquita:25: rust, Alpaquita:stream: rust

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0386 certfr-2026-avi-0386 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu… 2026-10-03T10:38:37.822971+00:00 certfr-2026-avi-0386 https://cve.radiocsirt.org/vuln/euvd-2026-276670 EUVD-2026-276670 2026-10-03T10:38:37.822991+00:00 EUVD-2026-276670 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33055 fkie_cve-2026-33055 2026-10-03T10:38:37.823004+00:00

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

 https://cve.radiocsirt.org/vuln/ghsa-gchp-q4r4-x4ff GHSA-gchp-q4r4-x4ff — tar-rs incorrectly ignores PAX size headers if header size is nonzero 2026-10-03T10:38:37.823031+00:00

Affected: crates.io: tar

### Summary

As part of [CVE-2025-62518](https://www.cve.org/CVERecord?id=CVE-2025-62518) the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header.

However, it was missed at the time that this project (the original Rust `tar` crate) had a conditional logic that skipped the PAX size header in the case that the base header size was nonzero - almost the inverse of the astral-tokio-tar issue.

The problem here is that *any* discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers.

In this case, the tar-rs (Rust `tar`) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go `archive/tar`) unconditionally use the PAX size override.

### Details

https://github.com/astral-sh/tokio-tar/blob/aafc2926f2034d6b3ad108e52d4cfc73df5d47a4/src/archive.rs#L578-L600 https://github.com/alexcrichton/tar-rs/blob/88b1e3b0da65b0c5b9750d1a75516145488f4793/src/archive.rs#L339-L344

### PoC

(originally posted by https://github.com/xokdvium)

> I was worried that cargo might be vulnerable to malicious crates, but it turns out that crates.io has been rejecting both symlinks and hard links:

It seems like recent fixes to https://edera.dev/stories/tarmageddon have introduced a differential that could be used to smuggle symlinks into the registry that would get skipped over by `astral-tokio-tar` but not by `tar-…

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-33055 msrc_CVE-2026-33055 — tar-rs incorrectly ignores PAX size headers if header size is nonzero 2026-10-03T10:38:37.823083+00:00 msrc_CVE-2026-33055 https://cve.radiocsirt.org/vuln/rustsec-2026-0068 RUSTSEC-2026-0068 — tar-rs incorrectly ignores PAX size headers if header size is nonzero 2026-10-03T10:38:37.823100+00:00

Affected: crates.io: tar

Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX size header in cases where the base header size is nonzero.

As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar] project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue.

Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size — other tar parsers (including e.g. Go [`archive/tar`][go-tar]) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers.

This issue has been fixed in version 0.4.45.

[astral-cve]: https://www.cve.org/CVERecord?id=CVE-2025-62518 [astral-tokio-tar]: https://github.com/astral-sh/tokio-tar [go-tar]: https://pkg.go.dev/archive/tar

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33055 UBUNTU-CVE-2026-33055 2026-10-03T10:38:37.823129+00:00

Affected: Ubuntu:Pro:20.04:LTS: rust-tar, Ubuntu:Pro:22.04:LTS: rust-tar, Ubuntu:24.04:LTS: rust-tar, Ubuntu:25.10: rust-tar, Ubuntu:26.04:LTS: rust-tar

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.