Skip to content
OpenAdvisories

Package · Ubuntu

rust-async-tar

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-53600

    async-tar PAX extension-header desync enables tar entry/content smuggling

    async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next…

    dignifiedquire async-tar rust-async-tar async-tar Debian Ubuntu crates.io
  • Medium 5.1
    CVE-2026-33056

    tar-rs: unpack_in can chmod arbitrary directories by following symlinks

    tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() fo…

    alexcrichton tar-rs rustc rustc Debian Ubuntu Alpine crates.io