tar-rs incorrectly ignores PAX size headers if header size is nonzero
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alexcrichton | tar-rs | before 0.4.45 | 0.4.45 | Patch available | CNA |
| — | tar (crates.io) | before 0.4.45 | 0.4.45 | Patch available | GHSA-gchp-q4r4-x4ff |
- tar-rs Vendoralexcrichton Affected before 0.4.45 Fixed in 0.4.45 Patch available CNA
- tar (crates.io) Vendor— Affected before 0.4.45 Fixed in 0.4.45 Patch available GHSA-gchp-q4r4-x4ff
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:alexcrichton:tar-rs:*:*:*:*:*:rust:*:* | before 0.4.45 | Vulnerable | alexcrichton |
- cpe:2.3:a:alexcrichton:tar-rs:*:*:*:*:*:rust:*:* Versions before 0.4.45 Vulnerable ·alexcrichton
Remediation
- Fix · CNA tar-rs (alexcrichton) Fixed in 0.4.45
- Fix · GHSA-gchp-q4r4-x4ff tar (crates.io) Fixed in 0.4.45 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33055
- 2026-10-03 Alias added: GHSA-gchp-q4r4-x4ff
References
Advisory 2
Sources
- CVE-2026-33055 · CVE Program
- CVE-2026-33055 · NVD
- FIRST EPSS
- GHSA-gchp-q4r4-x4ff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences