{"id":"GHSA-fp55-jw48-c537","revision":"b7ef8c0e08434663860864bb9dcf6aa0","records":[{"revision":"b7ef8c0e08434663860864bb9dcf6aa0","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-fp55-jw48-c537","aliases":["RUSTSEC-2026-0112"],"title":"astral-tokio-tar is Vulnerable to PAX Header Desynchronization","description":"### Impact\n\nVersions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.\n\nSee GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar.\n\n### Patches\n\nVersions 0.6.1 and newer of astral-tokio-tar address this differential.\n\n### Workarounds\n\nUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.\n\nThere is no workaround other than upgrading. Users should experience no breaking changes as a result of the upgrade.\n\n### Resources\n\n- GHSA-j5gw-2vrg-8fgx is a similar PAX desynchronization bug\n\n### Attribution\n\n- Reporter: Adam Harvey (@lawngnome)","state":0,"publishedAt":"2026-05-06T17:26:12+00:00","modifiedAt":"2026-09-10T03:50:46.705838+00:00","affected":[{"ecosystem":"crates.io","name":"astral-tokio-tar","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.6.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-fp55-jw48-c537","https://github.com/advisories/GHSA-fp55-jw48-c537","https://github.com/astral-sh/tokio-tar","https://rustsec.org/advisories/RUSTSEC-2026-0112.html"],"sourceUrl":"https://github.com/advisories/GHSA-fp55-jw48-c537","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fp55-jw48-c537","identifiers":["GHSA-fp55-jw48-c537","RUSTSEC-2026-0112"]},"retained":false,"historicalAffected":[]}],"coverage":[]}