# composefs tar-rs PAX header desynchronization

Source: https://junglewise.ai/threats/composefs-tar-rs-pax-header-desynchronization-aa3a4389  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 0 · Published 2026-05-29

A vulnerability in the tar-rs library, a tool used by developers to handle tar archive files in Rust applications, could allow an attacker to hide malicious files or cause data to be processed incorrectly. By specially crafting an archive, an attacker can trick the software into misinterpreting where files begin and end. This could lead to security tools failing to detect a threat or applications extracting different content than intended, potentially compromising system integrity.

Technologies: [Alex Crichton Tar-Rs](https://junglewise.ai/threats/technologies/tar-rs). Vendors: [Alex Crichton](https://junglewise.ai/threats/vendors/alex-crichton).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 0, published 29 May 2026.

**Which products and versions are affected?** Alex Crichton Tar-Rs <= 0.4.45.

**Is there a fix for This vulnerability?** A patch was published on 2026-05-29: Fixed in version 0.4.46 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected?** Check whether you run Alex Crichton Tar-Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PAX header desynchronization vulnerability exists in tar-rs due to improper handling of the PAX 'x' header. According to POSIX standards, a PAX header should apply specifically to the next file entry; however, tar-rs applies it to the immediate next entry regardless of type (e.g., applying it to a GNU longname 'L' entry instead of the intended file). An attacker can exploit this by crafting a tar stream with a sequence of headers that causes tar-rs to apply a 'size' extension to an intermediary header. This desynchronizes the parser, allowing for attacker-controlled skippage or extraction of members that differ from other standard tar parsers. This can be used to bypass security scanners or obscure malicious payloads. The issue is fixed in version 0.4.46.

## Affected products

- composefs tar-rs <= 0.4.45

## Timeline

- 2026-05-18: disclosed
- 2026-05-29: advisory
- 2026-05-29: patched: Fixed in version 0.4.46

## References

- [https://api.github.com/users/woodruffw](https://api.github.com/users/woodruffw)
- [https://github.com/woodruffw](https://github.com/woodruffw)
- [https://api.github.com/users/woodruffw/gists%7B/gist_id%7D](https://api.github.com/users/woodruffw/gists%7B/gist_id%7D)
- [https://api.github.com/users/woodruffw/repos](https://api.github.com/users/woodruffw/repos)
- [https://avatars.githubusercontent.com/u/3059210?v=4](https://avatars.githubusercontent.com/u/3059210?v=4)
- [https://api.github.com/users/woodruffw/events%7B/privacy%7D](https://api.github.com/users/woodruffw/events%7B/privacy%7D)

## Related threats

- [Rust tar-rs archive parsing discrepancy via PAX size header ignore](https://junglewise.ai/threats/cve-2026-33055-rust-tar-rs-archive-parsing-discrepancy-via-pax-size-header)