[SECURITY] Fedora 44 Update: rust-reqsign-file-read-tokio-3.0.0-1.fc44

Tokio-based file reader implementation for reqsign...

[SECURITY] Fedora 44 Update: rust-reqsign-command-execute-tokio-3.0.0-1.fc44

Tokio-based command execution implementation for reqsign...

Fedora 43 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-d18cf572b8)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-d18cf572b8 advisory. Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv...

Fedora 44 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-e22a7dbf2d)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-e22a7dbf2d advisory. Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv...

Fedora 45 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-c6c01a71f2)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-c6c01a71f2 advisory. Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45 to 0.4.45, fixing CVE-2026-33056. Update uv and...

GHSA-GCHP-Q4R4-X4FF tar-rs incorrectly ignores PAX size headers if header size is nonzero

Summary As part of CVE-2025-62518 the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. However, it was missed at the time that this project the original Rust tar crate had a conditional logic that skipped the PAX siz...

tar-rs incorrectly ignores PAX size headers if header size is nonzero

Summary As part of CVE-2025-62518 the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. However, it was missed at the time that this project the original Rust tar crate had a conditional logic that skipped the PAX siz...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +2100 more potentially affected by unknown CVE via tokio-codec (>=0.1.2, <=0.2.0-alpha.6)

tokio-codec CARGO version =0.1.2, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0056...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.6.2) +1929 more potentially affected by unknown CVE via tokio-udp (>=0.1.0, <=0.2.0-alpha.1)

tokio-udp CARGO version =0.1.0, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0-alpha.1, =0.3.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0064...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.7.1) +2899 more potentially affected by unknown CVE via tokio-threadpool (>=0.1.14, <=0.2.0-alpha.1)

tokio-threadpool CARGO version =0.1.14, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0051...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.6.2) +1842 more potentially affected by unknown CVE via tokio-uds (>=0.1.5, <=0.3.0-alpha.1)

tokio-uds CARGO version =0.1.5, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0 - actix-multipart-rfc7578 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0050...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3196 more potentially affected by unknown CVE via tokio-executor (>=0.1.10, <=0.2.0-alpha.6)

tokio-executor CARGO version =0.1.10, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0063...

a2 (>=0.2.0, <=0.5.0-alpha.7), abci (>=0.5.3, <=0.7.1) +3151 more potentially affected by unknown CVE via tokio-sync (>=0.1.8, <=0.2.0-alpha.6)

tokio-sync CARGO version =0.1.8, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0052...

RUSTSEC-2026-0052 `tokio-sync` is unmaintained

The tokio-sync crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

RUSTSEC-2026-0055 `tokio-process` is unmaintained

The tokio-process crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

`tokio-current-thread` is unmaintained

The tokio-current-thread crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

`tokio-reactor` is unmaintained

The tokio-reactor crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

`tokio-sync` is unmaintained

The tokio-sync crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

`tokio-uds` is unmaintained

The tokio-uds crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

RUSTSEC-2026-0059 `tokio-tcp` is unmaintained

The tokio-tcp crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...