Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 3 November 2026.
- Which products and versions are affected?
- Astral-Tokio-Tar all; astral-tokio-tar (crates.io) SEMVER:introduced=0.0.0-0.
- Is there a fix for This vulnerability?
- No fixed version is recorded yet. Migrate to actively maintained TAR encoding/decoding libraries such as tar-codec, which Astral recommends as a replacement. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is This vulnerability attacked?
- It is in a software library.
- Am I affected?
- Check whether you run Astral-Tokio-Tar or astral-tokio-tar (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Migrate to actively maintained TAR encoding/decoding libraries such as tar-codec, which Astral recommends as a replacement.
Technical details
astral-tokio-tar is a Rust crate for async TAR archive encoding and decoding that reached end-of-life on November 3, 2026. All versions (0.0.0 and later) are affected. No active security maintenance means any discovered vulnerabilities will not receive patches, and the codebase will drift relative to current Rust best practices and security standards.
Affected products
- Astral astral-tokio-tar all
Timeline
- 2026-11-03: disclosed: Maintenance ended