CVE-2026-53600

A flaw was found in async-tar, a library for reading and writing tar archives in Rust. The library incorrectly applies a buffered PAX size extension to an intermediary extension header instead of the intended next file entry. This allows an attacker to craft a malicious tar archive that manipulat...

CVE-2026-53600

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...

PT-2026-56681

Summary async-tar v0.6.0 mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening...