CVE-2026-53600 async-tar PAX extension-header desync enables tar entry/content smuggling

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...

CVE-2026-53600 async-tar PAX extension-header desync enables tar entry/content smuggling

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...

EUVD-2026-70200

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...

CVE-2026-53600

async-tar (crates.io), a tar archive reading/writing library for async Rust, is vulnerable in versions

RHSA-2026:61586 Red Hat Security Advisory: tar security, bug fix, and enhancement update

Bulletin has no description...

CVE-2026-70622

A flaw was found in tar-rs. This vulnerability, a symlink escape, allows a local attacker to read sensitive files outside of the intended directory. By planting specially crafted symbolic links in an untrusted directory, an attacker can trick a privileged process, when archiving that directory,...

AlmaLinux 10 : tar (ALSA-2026:61586)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:61586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escap...

MiracleLinux 9 : tar-1.34-13.el9_8 (AXSA:2026-1733:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1733:03 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path...

Oracle Linux 9 : ELSA-2026-61581-0: / tar (ELSA-2026-615810)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-615810 advisory. - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary...

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

ROOT-APP-NPM-CVE-2026-26960 CVE-2026-26960 in tar - Patched by Root

Root has patched CVE-2026-26960 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-31802 CVE-2026-31802 in tar - Patched by Root

Root has patched CVE-2026-31802 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24842 CVE-2026-24842 in tar - Patched by Root

Root has patched CVE-2026-24842 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-23950 CVE-2026-23950 in tar - Patched by Root

Root has patched CVE-2026-23950 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-29786 CVE-2026-29786 in tar - Patched by Root

Root has patched CVE-2026-29786 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-23745 CVE-2026-23745 in tar - Patched by Root

Root has patched CVE-2026-23745 in the tar package for Root:npm. Multiple fixed versions available...

RHSA-2026:61581 Red Hat Security Advisory: tar security, bug fix, and enhancement update

Bulletin has no description...

ROOT-APP-NPM-CVE-2024-28863 CVE-2024-28863 in tar - Patched by Root

Root has patched CVE-2024-28863 in the tar package for Root:npm. Multiple fixed versions available...

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...