Lucene search
+L

2 matches found

Github Security Blog
Github Security Blog
added 2026/03/17 7:49 p.m.10 views

astral-tokio-tar insufficiently validates PAX extensions during extraction

Impact In versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping rather than rejection of invalid PAX extensions could be used as a building block for a parser differential, for example by having...

6.3CVSS5.8AI score0.00249EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder