---
id: CVE-2026-53600
title: async-tar is a tar archive reading/writing library for async Rust
summary: >-
  async-tar is a tar archive reading/writing library for async Rust. Prior to
  version 0.6.1, async-tar mis-applies a buffered PAX size extension to an
  intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX
  x/g header) …
severity: medium
cwe:
  - CWE-20
  - CWE-843
vendor: async-tar
product: async-tar
affected:
  - async-tar < 0.6.1
patched:
  - async-tar 0.6.1
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53600'
references:
  - url: 'https://github.com/dignifiedquire/async-tar/releases/tag/v0.6.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m
    label: security-advisories@github.com
  - url: >-
      https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-35rm-7j9c-2f7m'
tags:
  - nvd
  - ghsa
  - rust
epss: 0.00445
epssPercentile: 0.36039
aliases:
  - GHSA-35rm-7j9c-2f7m
ecosystem: rust
ingestedAt: '2026-07-08T20:46:41.634Z'
---

## Overview

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because poll_next_raw (src/archive.rs) threads the buffered PAX records into the size computation of whatever raw header it reads next — and that header can be an intermediary L — the stream cursor is advanced by an attacker-chosen amount when the L body is consumed. The parser then desyncs relative to a POSIX-correct tar parser (e.g. GNU tar), reading subsequent bytes at the wrong block boundary. This issue has been patched in version 0.6.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53600)

Affected packages:

- `async-tar < 0.6.1`

Patched in:

- `async-tar 0.6.1`

Source: https://github.com/advisories/GHSA-35rm-7j9c-2f7m