1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32766

CVE-2026-32766: astral-tokio-tar insufficiently validates PAX extensions during extraction

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32766

CVE-2026-32766:

1.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
astral-tokio-tar	rust	<= 0.5.6	0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in astral-tokio-tar (GHSA-6gx3-4362-rf54) was caused by the insufficient validation of PAX extensions in tar archives. The core issue, identified in the patch commit e5e0139cae4577eeedf5fc16b65e690bf988ce52, was the repeated use of the .filter_map(|res| res.ok()) pattern when processing PAX extension data. This code pattern silently discarded any errors that occurred during the parsing of these extensions, causing the library to ignore malformed data instead of rejecting the archive as invalid.

An attacker could exploit this by crafting a tar file with a malformed PAX extension for a file path, link path, or extended attribute. The vulnerable library would silently skip the malformed extension and fall back to the standard tar header, while a different, compliant tar parser might interpret the data differently, leading to a "parser differential" attack. This could result in outcomes like file path traversal or incorrect file permissions, depending on the behavior of the secondary parser.

The patch addresses this vulnerability by removing the error-suppressing code and instead explicitly handling potential errors. It replaces the .filter_map() calls with a for loop that uses the ? operator to propagate any Err results from the PAX extension iterator. This ensures that any malformed extension will now cause the parsing process to fail immediately, which is the correct and secure behavior.

The primary vulnerable functions are tokio_tar::entry::EntryFields::path_bytes, tokio_tar::entry::EntryFields::link_name_bytes, and tokio_tar::entry::EntryFields::set_xattrs, all of which are located in src/entry.rs and contained this flawed error-handling logic.

Vulnerable functions

tokio_tar::entry::EntryFields::path_bytes

src/entry.rs

The function was vulnerable because it used `.filter_map(|f| f.ok())` to process PAX extensions. This pattern silently discards any errors encountered during extension parsing, allowing a malformed 'path' extension to be ignored instead of rejected. An attacker could leverage this to create a parser differential with another tar utility. The patch fixes this by iterating and propagating errors with `?`.

tokio_tar::entry::EntryFields::link_name_bytes

src/entry.rs

Similar to `path_bytes`, this function was vulnerable due to the use of `.filter_map(|f| f.ok())`, which silently ignored errors while parsing PAX extensions for a 'linkpath'. This could allow a malformed long link name to be skipped, leading to inconsistencies when processed by different tar parsers. The patch ensures errors are propagated.

tokio_tar::entry::EntryFields::set_xattrs

src/entry.rs

This function, which processes extended file attributes from PAX extensions, used the same vulnerable pattern of `.filter_map(|e| e.ok())`. This caused any malformed extended attribute data in the tar archive to be silently skipped. The patch refactors the logic to properly handle and propagate parsing errors.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.