astral-sh tokio-tar

• CVE-2026-32766 Low 1.7 astral-tokio-tar insufficiently validates PAX extensions during extraction 0.3%
• CVE-2025-62518 High 8.1 astral-tokio-tar Vulnerable to PAX Header Desynchronization 0.7%
• CVE-2025-59825 Medium 6.1 astral-tokio-tar has a path traversal in tar extraction 0.2%