Skip to content
OpenAdvisories

Package · Debian

rust-astral-tokio-tar

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 1.7
    CVE-2026-32766

    astral-tokio-tar insufficiently validates PAX extensions during extraction

    astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be …

    astral-sh tokio-tar wasmcloud pixi Debian Ubuntu Wolfi crates.io
  • High 8.1
    CVE-2025-62518 Public exploit

    astral-tokio-tar Vulnerable to PAX Header Desynchronization

    astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar hea…

    astral-sh tokio-tar wash pixi Debian Ubuntu Wolfi crates.io
  • Medium 6.1
    CVE-2025-59825

    astral-tokio-tar has a path traversal in tar extraction

    astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. Additionally, the En…

    astral-sh tokio-tar astral-tokio-tar rust-astral-tokio-tar Debian Ubuntu crates.io