Skip to content
OpenAdvisories

Vendor

astral-sh

9 known vulnerabilities.

Products

uv 6 tokio-tar 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 1.7
    CVE-2026-32766

    astral-tokio-tar insufficiently validates PAX extensions during extraction

    astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be …

    astral-sh tokio-tar wasmcloud pixi Debian Ubuntu Wolfi crates.io