Most recent entries from all

BELL-CVE-2026-33055

Affected: Alpaquita:23: rust, Alpaquita:25: rust, Alpaquita:stream: rust

certfr-2026-avi-0386 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0386

EUVD-2026-276670

fkie_cve-2026-33055

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

GHSA-gchp-q4r4-x4ff — tar-rs incorrectly ignores PAX size headers if header size is nonzero

Affected: crates.io: tar

### Summary

As part of [CVE-2025-62518](https://www.cve.org/CVERecord?id=CVE-2025-62518) the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header.

However, it was missed at the time that this project (the original Rust `tar` crate) had a conditional logic that skipped the PAX size header in the case that the base header size was nonzero - almost the inverse of the astral-tokio-tar issue.

The problem here is that *any* discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers.

In this case, the tar-rs (Rust `tar`) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go `archive/tar`) unconditionally use the PAX size override.

### Details

https://github.com/astral-sh/tokio-tar/blob/aafc2926f2034d6b3ad108e52d4cfc73df5d47a4/src/archive.rs#L578-L600 https://github.com/alexcrichton/tar-rs/blob/88b1e3b0da65b0c5b9750d1a75516145488f4793/src/archive.rs#L339-L344

### PoC

(originally posted by https://github.com/xokdvium)

> I was worried that cargo might be vulnerable to malicious crates, but it turns out that crates.io has been rejecting both symlinks and hard links:

It seems like recent fixes to https://edera.dev/stories/tarmageddon have introduced a differential that could be used to smuggle symlinks into the registry that would get skipped over by `astral-tokio-tar` but not by `tar-…

msrc_CVE-2026-33055 — tar-rs incorrectly ignores PAX size headers if header size is nonzero

msrc_CVE-2026-33055

RUSTSEC-2026-0068 — tar-rs incorrectly ignores PAX size headers if header size is nonzero

Affected: crates.io: tar

Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX size header in cases where the base header size is nonzero.

As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar] project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue.

Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size — other tar parsers (including e.g. Go [`archive/tar`][go-tar]) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers.

This issue has been fixed in version 0.4.45.

[astral-cve]: https://www.cve.org/CVERecord?id=CVE-2025-62518 [astral-tokio-tar]: https://github.com/astral-sh/tokio-tar [go-tar]: https://pkg.go.dev/archive/tar

UBUNTU-CVE-2026-33055

Affected: Ubuntu:Pro:20.04:LTS: rust-tar, Ubuntu:Pro:22.04:LTS: rust-tar, Ubuntu:24.04:LTS: rust-tar, Ubuntu:25.10: rust-tar, Ubuntu:26.04:LTS: rust-tar