astral-tokio-tar insufficiently validates PAX extensions during extraction

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-32766 · CVE overview and exploitation status

EUVD-2026-13414

GHSA-6gx3-4362-rf54

RUSTSEC-2026-0066

cve-program · CVE-2026-32766

• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54
• https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52

euvd · EUVD-2026-13414

• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54
• https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52

nvd · CVE-2026-32766

• https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52
• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54

osv · GHSA-6gx3-4362-rf54

• https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54
• https://nvd.nist.gov/vuln/detail/CVE-2026-32766
• https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52
• https://github.com/astral-sh/tokio-tar
• https://rustsec.org/advisories/RUSTSEC-2026-0066.html

osv · RUSTSEC-2026-0066

• https://crates.io/crates/astral-tokio-tar
• https://rustsec.org/advisories/RUSTSEC-2026-0066.html

No related changes are available here.