MEDIUMcrates.io
GHSA-3cv2-h65g-fgmm· RUSTSEC-2026-0145astral-tokio-tar has a PAX Header Desynchronization issue
Modified: 5/29/2026
package
crates.io/astral-tokio-tar
pkg:crates.io/astral-tokio-tar
MEDIUMcrates.io
GHSA-3wgq-wrwc-vqmv· CVE-2025-59825astral-tokio-tar has a path traversal in tar extraction
Modified: 11/18/2025
MEDIUM5.3crates.io
GHSA-6gx3-4362-rf54· CVE-2026-32766, RUSTSEC-2026-0066astral-tokio-tar insufficiently validates PAX extensions during extraction
Modified: 9/10/2026
MEDIUMcrates.io
GHSA-fp55-jw48-c537· RUSTSEC-2026-0112astral-tokio-tar is Vulnerable to PAX Header Desynchronization
Modified: 9/10/2026
HIGH8.1crates.io
GHSA-j5gw-2vrg-8fgx· CVE-2025-62518, RUSTSEC-2025-0110astral-tokio-tar Vulnerable to PAX Header Desynchronization
Modified: 9/10/2026
LOWcrates.io
GHSA-xx64-wwv2-hcqq· RUSTSEC-2026-0113astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
Modified: 9/10/2026
HIGH8.1crates.io
RUSTSEC-2025-0110· CVE-2025-62518, GHSA-j5gw-2vrg-8fgxastral-tokio-tar Vulnerable to PAX Header Desynchronization
Modified: 1/17/2026
—crates.io
RUSTSEC-2026-0066· CVE-2026-32766, GHSA-6gx3-4362-rf54Insufficient validation of PAX extensions during extraction
Modified: 3/23/2026
—crates.io
RUSTSEC-2026-0112· GHSA-fp55-jw48-c537PAX Header Desynchronization in astral-tokio-tar
Modified: 4/28/2026
—crates.io
RUSTSEC-2026-0113· GHSA-xx64-wwv2-hcqq`unpack_in` can chmod arbitrary directories by following symlinks
Modified: 4/28/2026
—crates.io
RUSTSEC-2026-0145· GHSA-3cv2-h65g-fgmmPAX Header Desynchronization in astral-tokio-tar
Modified: 5/19/2026