Executive brief
A vulnerability in the tar-rs library, a tool used by developers to handle tar archive files in Rust applications, could allow an attacker to hide malicious files or cause data to be processed incorrectly. By specially crafting an archive, an attacker can trick the software into misinterpreting where files begin and end. This could lead to security tools failing to detect a threat or applications extracting different content than intended, potentially compromising system integrity.
Technical details
A PAX header desynchronization vulnerability exists in tar-rs due to improper handling of the PAX 'x' header. According to POSIX standards, a PAX header should apply specifically to the next file entry; however, tar-rs applies it to the immediate next entry regardless of type (e.g., applying it to a GNU longname 'L' entry instead of the intended file). An attacker can exploit this by crafting a tar stream with a sequence of headers that causes tar-rs to apply a 'size' extension to an intermediary header. This desynchronizes the parser, allowing for attacker-controlled skippage or extraction of members that differ from other standard tar parsers. This can be used to bypass security scanners or obscure malicious payloads. The issue is fixed in version 0.4.46.
Affected products
- composefs tar-rs <= 0.4.45
Timeline
- 2026-05-18: disclosed
- 2026-05-29: advisory
- 2026-05-29: patched: Fixed in version 0.4.46