CVE-2026-33055: Rust tar-rs archive parsing discrepancy via PAX size header ignore

CVE-2026-33055 · Severity: high · CVSS 8.1 · Published 2026-03-20

The Rust 'tar' library, used for handling archive files, contains a logic error that causes it to process files differently than other common tools. This discrepancy allows an attacker to create a malicious archive that hides dangerous files (like symlinks to sensitive system data) from security scanners while still allowing them to be extracted by the application. This could lead to unauthorized access to sensitive files or system compromise if the library is used in automated deployment or package management systems.

Technologies: Alex Crichton Tar-Rs, tar (crates.io). Vendors: Alex Crichton, crates.io.

Quick answers

Is CVE-2026-33055 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33055 being exploited in the wild.
How severe is CVE-2026-33055?
High severity, with a CVSS score of 8.1, published 20 March 2026.
Which products and versions are affected?
Alex Crichton Tar-Rs <= 0.4.44; tar (crates.io) SEMVER:introduced=0,fixed=0.4.45, SEMVER:introduced=0.0.0-0,fixed=0.4.45.
Is there a fix for CVE-2026-33055?
Yes. tar (crates.io): upgrade to 0.4.45 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33055 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33055?
Check whether you run Alex Crichton Tar-Rs or tar (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • tar (crates.io): upgrade to 0.4.45 or later
    cargo update -p tar

Technical details

The tar-rs crate contains a logic error where it skips PAX (Portable Archive Exchange) size headers if the base header size is non-zero. This creates a differential parsing vulnerability when compared to other tar implementations (like Go's archive/tar or tokio-tar) which unconditionally honor PAX size overrides. An attacker can exploit this discrepancy to 'smuggle' entries, such as symlinks, into an archive. For example, a security scanner using one library might skip over a section of the archive it believes is part of a previous file's padding, while tar-rs (used by the actual extraction tool) would see and extract a malicious symlink. This is particularly impactful for ecosystems like crates.io and cargo that may use different underlying libraries for validation and extraction. The issue is fixed in version 0.4.45.

Affected products

  • alexcrichton tar-rs <= 0.4.44

Identifiers

  • CVE-2026-33055
  • GHSA-gchp-q4r4-x4ff
  • RUSTSEC-2026-0068

Timeline

  • 2026-03-19: disclosed
  • 2026-03-19: patched: Fixed in version 0.4.45
  • 2026-03-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.