Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M
CVE-2026-33055tar-rs incorrectly ignores PAX size headers if header size is nonzero
Medium 5.1
In plain English
A medium-severity type confusion in tar-rs from alexcrichton. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rust-tar | no fix listed | DEBIAN-CVE-2026-33055 |
| Debian:13 | rust-tar | no fix listed | DEBIAN-CVE-2026-33055 |
| Debian:14 | rust-tar | 0.4.45-1 | DEBIAN-CVE-2026-33055 |
| Debian:12 | rustc | no fix listed | DEBIAN-CVE-2026-33055 |
| Debian:13 | rustc | 1.85.1+dfsg1-1+deb13u1 | DEBIAN-CVE-2026-33055 |
| Debian:14 | rustc | 1.92.0+dfsg1-2 | DEBIAN-CVE-2026-33055 |
| Ubuntu:24.04:LTS | rust-tar | no fix listed | UBUNTU-CVE-2026-33055 |
| Ubuntu:25.10 | rust-tar | no fix listed | UBUNTU-CVE-2026-33055 |
| Ubuntu:26.04:LTS | rust-tar | no fix listed | UBUNTU-CVE-2026-33055 |
| Ubuntu:26.10 | rust-tar | no fix listed | UBUNTU-CVE-2026-33055 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| alexcrichton | tar-rs | < 0.4.45 |
Weakness: CWE-843 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-gchp-q4r4-x4ff x_refsource_CONFIRM
- https://github.com/alexcrichton/tar-rs/commit/de1a5870e603758f430073688691165f21a33946 x_refsource_MISC
- https://www.cve.org/CVERecord?id=CVE-2025-62518 x_refsource_MISC