Astral astral-tokio-tar PAX header desynchronization

Executive brief

astral-tokio-tar is a library used to read and write tar archives in Rust applications. A vulnerability in how it handles archive headers allows an attacker to create specially crafted files that appear differently to this library than to other standard tools. This could allow an attacker to 'smuggle' malicious files onto a system that would be ignored by security scanners but extracted by the affected application.

Technical details

The astral-tokio-tar library incorrectly applies PAX headers ('x') to the immediate next entry in a tar stream regardless of its type, violating the POSIX pax specification which requires PAX headers to apply only to file entries. By inserting intermediary entries like GNU longname ('L') headers between a PAX header and a file, an attacker can cause a desynchronization of the stream. This differential in parsing allows an attacker to craft archives where specific members are skipped or extracted differently by astral-tokio-tar compared to other tar implementations. This vulnerability is classified as Improper Input Validation (CWE-20) and Type Confusion (CWE-843). The issue is resolved in version 0.6.2.

Affected products

• Astral astral-tokio-tar <= 0.6.1

Timeline

• 2026-05-18: disclosed: Initial disclosure to maintainers
• 2026-05-29: advisory: GitHub Advisory published
• 2026-05-29: patched: Version 0.6.2 released

References

• https://api.github.com/users/woodruffw
• https://github.com/woodruffw
• https://api.github.com/users/woodruffw/gists%7B/gist_id%7D
• https://api.github.com/users/woodruffw/repos
• https://avatars.githubusercontent.com/u/3059210?v=4
• https://api.github.com/users/woodruffw/events%7B/privacy%7D