{"id":"RUSTSEC-2026-0112","aliases":["GHSA-fp55-jw48-c537"],"title":"PAX Header Desynchronization in astral-tokio-tar","summary":"PAX Header Desynchronization in astral-tokio-tar","severity":"none","vendor":"astral-tokio-tar","product":"astral-tokio-tar","ecosystem":"rust","affected":["astral-tokio-tar >= 0.0.0-0, < 0.6.1"],"patched":["astral-tokio-tar 0.6.1"],"published":"2026-04-27","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:08.226377588Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0112","references":[{"url":"https://crates.io/crates/astral-tokio-tar"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0112.html"},{"url":"https://github.com/astral-sh/tokio-tar/commit/6f4f9ebc180f4d39d66d9c584a3796c0b9ae34c1"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.189Z","slug":"RUSTSEC-2026-0112","body":"## Overview\n\nVersions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation\nbug that allows manipulated entries to be made selectively visible or invisible\nduring extraction with astral-tokio-tar versus other tar implementations.\nAn attacker could use this differential to smuggle unexpected files onto a\nvictim's filesystem.\n\n## Affected packages\n\n- `astral-tokio-tar >= 0.0.0-0, < 0.6.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `astral-tokio-tar 0.6.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}