{"id":"CVE-2026-53600","title":"async-tar is a tar archive reading/writing library for async Rust","summary":"async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) …","severity":"medium","cwe":["CWE-20","CWE-843"],"vendor":"async-tar","product":"async-tar","affected":["async-tar < 0.6.1"],"patched":["async-tar 0.6.1"],"published":"2026-09-02","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53600","references":[{"url":"https://github.com/dignifiedquire/async-tar/releases/tag/v0.6.1","label":"security-advisories@github.com"},{"url":"https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m","label":"security-advisories@github.com"},{"url":"https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-35rm-7j9c-2f7m"}],"tags":["nvd","ghsa","rust"],"epss":0.00324,"epssPercentile":0.25673,"aliases":["GHSA-35rm-7j9c-2f7m"],"ecosystem":"rust","ingestedAt":"2026-07-08T20:46:41.634Z","slug":"CVE-2026-53600","body":"## Overview\n\nasync-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because poll_next_raw (src/archive.rs) threads the buffered PAX records into the size computation of whatever raw header it reads next — and that header can be an intermediary L — the stream cursor is advanced by an attacker-chosen amount when the L body is consumed. The parser then desyncs relative to a POSIX-correct tar parser (e.g. GNU tar), reading subsequent bytes at the wrong block boundary. This issue has been patched in version 0.6.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53600)\n\nAffected packages:\n\n- `async-tar < 0.6.1`\n\nPatched in:\n\n- `async-tar 0.6.1`\n\nSource: https://github.com/advisories/GHSA-35rm-7j9c-2f7m","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}