Поиск уязвимостей
Количество 6
Количество 6
CVE-2026-33055
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.
CVE-2026-33055
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.
CVE-2026-33055
tar-rs incorrectly ignores PAX size headers if header size is nonzero
CVE-2026-33055
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4 ...
GHSA-gchp-q4r4-x4ff
tar-rs incorrectly ignores PAX size headers if header size is nonzero
ALT-PU-2026-5285
ALT-PU-2026-5285: package `rust` update to version 1.94.1-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45. | CVSS3: 8.1 | 0% Низкий | 8 месяцев назад |
 | CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45. | CVSS3: 8.1 | 0% Низкий | 8 месяцев назад |
 | CVE-2026-33055 tar-rs incorrectly ignores PAX size headers if header size is nonzero | 0% Низкий | 7 месяцев назад | |
| CVE-2026-33055 tar-rs is a tar archive reading/writing library for Rust. Versions 0.4 ... | CVSS3: 8.1 | 0% Низкий | 8 месяцев назад |
| GHSA-gchp-q4r4-x4ff tar-rs incorrectly ignores PAX size headers if header size is nonzero | CVSS3: 8.1 | 0% Низкий | 8 месяцев назад |
| ALT-PU-2026-5285 ALT-PU-2026-5285: package `rust` update to version 1.94.1-alt1 | CVSS3: 8.1 | 7 месяцев назад |
Уязвимостей на страницу