CVE-2026-33055: Access of Resource Using Incompatible Type

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...

CVE-2026-33040: Integer Overflow or Wraparound

libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE contr...

PT-2026-26687

Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from incoming DCC SEND requests. A remote IRC user could send a filename with path traversal sequences like ../../.ssh/authorized keys and the fi...

rust-libp2p 输入验证错误漏洞

rust-libp2p is a Rust implementation of the libp2p open-source network stack. Prior to version 0.49.3, rust-libp2p had a vulnerability related to input validation errors. This vulnerability stemmed from the Gossipsub implementation accepting PRUNE evolutions controlled by attackers and potentiall...

CVE-2026-33055

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...

tar-rs 安全漏洞

tar-rs is a Rust library for reading and writing tar archive files, developed by Alex Crichton. Versions of tar-rs prior to 0.4.44 contain security vulnerabilities. These vulnerabilities stem from defects in the unpackdir function, which handles symbolic links. Such defects could lead to arbitrar...

http-api-problem (>=0.23.0, <=0.50.2) potentially affected by CVE-2026-33241 via salvo (>=0.9.7, <=0.11.6)

salvo CARGO version =0.9.7, =0.23.0, =0.50.2 Source cves: CVE-2026-33241 Source advisory: OSV:GHSA-PP9R-XG4C-8J4X...

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Details A Path Traversal and Access Control Bypass vulnerability was discovered in the salvo-proxy component of the Salvo Rust framework v0.89.2. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths e.g., protected...

RUSTSEC-2026-0068 tar-rs incorrectly ignores PAX size headers if header size is nonzero

Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518astral-cve, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the...

aati (>=0.10.2, <=0.11.3), acpica-bindings (>=0.1.0, <=0.1.2) +1758 more potentially affected by CVE-2026-33055 via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.2.0, =0.9.0, =0.2.5-rc.5, =1.2.0, =0.5.4-rc.1, =0.5.4-rc.1, =0.6.0, =0.4.0, =0.4.2 and more Source cves: CVE-2026-33055 Source advisory: OSV:RUSTSEC-2026-0068...

aati (>=0.10.2, <=0.11.3), acpica-bindings (>=0.1.0, <=0.1.2) +1758 more potentially affected by CVE-2026-33056 via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.23.0, =0.23.0, =0.2.0, =0.9.0, =0.2.5-rc.5, =1.2.0, =0.5.4-rc.1, =0.5.4-rc.1, =0.6.0, =0.4.0, =0.4.2 and more Source cves: CVE-2026-33056 Source advisory: OSV:RUSTSEC-2026-0067...

`unpack_in` can chmod arbitrary directories by following symlinks

In versions 0.4.44 and below of tar-rs, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadatafs-metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball containing a symlink entry followed by a...

PT-2026-26570

Name of the Vulnerable Software and Affected Versions tar-rs versions 0.4.44 and below Description tar-rs, a Rust library for reading and writing tar archives, contains a flaw in its handling of PAX size headers. Specifically, versions 0.4.44 and below have conditional logic that skips the PAX si...

openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:20364-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20364-1 advisory. - Update to version 0.2.8+116: - CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. bsc1257908...

PT-2026-26181

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.3 Description The libp2p-rust Gossipsub implementation is susceptible to a remote, unauthenticated denial-of-service condition. The implementation accepts attacker-controlled PRUNE backoff values and performs...

Security update for clamav

This update for clamav fixes the following issues: Update to clamav 1.5.2: Security issue: CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to denial of service conditions via a crafted HTML file bsc1259207. Non security issue: Support...

SUSE-SU-2026:0906-1 Security update for clamav

This update for clamav fixes the following issues: Update to clamav 1.5.2: Security issue: - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to denial of service conditions via a crafted HTML file bsc1259207. Non security issue: - Support...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +180 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.28.2, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =3.1.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:RUSTSEC-2026-0041...

Linux Distros Unpatched Vulnerability : CVE-2026-32829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +180 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.28.2, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =3.1.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:GHSA-VVP9-7P8X-RFVV...