CVE-2026-33055

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

• CWE-843

• https://github.com/alexcrichton/tar-rs/commit/de1a5870e603758f430073688691165f21a33946Patch
• https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-gchp-q4r4-x4ffExploit, Vendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2025-62518Third Party Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33045Home Assistant is open source home automation software that …5.4
• CVE-2026-33046Indico is an event management system that uses Flask-Multipa…8.8
• CVE-2026-33051Craft CMS is a content management system (CMS). In versions …5.4
• CVE-2026-33052Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-33053Langflow is a tool for building and deploying AI-powered age…8.8
• CVE-2026-33054Mesop is a Python-based UI framework that allows users to bu…9.8
• CVE-2026-33056tar-rs is a tar archive reading/writing library for Rust. In…6.5
• CVE-2026-33057Mesop is a Python-based UI framework that allows users to bu…9.8
• CVE-2026-33058Kanboard is project management software focused on Kanban me…6.5
• CVE-2026-3306An improper authorization vulnerability was identified in Gi…4.3
• CVE-2026-33060CKAN MCP Server is a tool for querying CKAN open data portal…5.7
• CVE-2026-33061Jexactyl is a customisable game management panel and billing…5.4