Executive Summary

CVE-2026-32766 is a vulnerability in the astral-tokio-tar Rust library, which handles reading and writing tar archives asynchronously. In versions 0.5.6 and earlier, the library silently skipped malformed PAX extensions when parsing tar archives instead of rejecting them. This means that invalid metadata extensions in tar files were ignored without error.

This silent skipping can be exploited as part of a parser differential attack, where astral-tokio-tar ignores malformed extensions but another tar parser might misinterpret them, potentially leading to incorrect or unsafe archive extraction behavior. However, exploiting this vulnerability requires a secondary tar parser that improperly validates PAX extensions.

The issue was fixed in version 0.6.0 by enforcing strict validation and error propagation for malformed PAX extensions, ensuring that invalid extensions cause extraction errors rather than being silently ignored.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you if you use astral-tokio-tar to extract tar archives and also rely on another tar parser that does not properly validate malformed PAX extensions. Because astral-tokio-tar silently skips malformed extensions, a secondary parser might misinterpret these extensions, potentially leading to incorrect extraction results or unsafe handling of archive contents.

In practice, the impact is considered low severity because exploitation requires a secondary vulnerable tar parser. If you only use astral-tokio-tar or use tar parsers that correctly validate PAX extensions, the risk is minimal.

Upgrading to astral-tokio-tar version 0.6.0 or later mitigates this issue by rejecting malformed PAX extensions and preventing silent skipping.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability involves the silent skipping of malformed PAX extensions in tar archives by the astral-tokio-tar library versions 0.5.6 and earlier. Detection involves identifying tar archive extraction processes using vulnerable versions of the astral-tokio-tar crate.'}, {'type': 'paragraph', 'content': 'Since the vulnerability manifests during tar archive parsing, one way to detect it is by attempting to extract tar files with malformed PAX extensions using the vulnerable library and observing if errors are raised or if malformed extensions are silently skipped.'}, {'type': 'paragraph', 'content': 'Specific commands to detect the vulnerability are not provided in the available resources. However, users can check the version of the astral-tokio-tar crate used in their Rust projects by inspecting the Cargo.lock or Cargo.toml files, for example:'}, {'type': 'list_item', 'content': "grep 'tokio-tar' Cargo.lock"}, {'type': 'list_item', 'content': 'cargo tree | grep tokio-tar'}, {'type': 'paragraph', 'content': 'To detect malformed PAX extensions in tar archives, specialized scripts or tools that validate PAX headers strictly would be needed, but such tools or commands are not detailed in the provided resources.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the astral-tokio-tar Rust crate to version 0.6.0 or later, where the vulnerability has been fixed by enforcing strict validation and error propagation for malformed PAX extensions.

Users extracting tar files with poorly constructed PAX extensions may encounter errors after upgrading and should consider reconstructing their tar files using a conforming tar parser.

Since exploitation requires a secondary vulnerable tar parser that improperly processes malformed PAX extensions, ensuring that all tar parsers in use properly validate PAX extensions can further reduce risk.

Useful 0 Not Useful 0