CVE-2026-32766: astral-sh tokio-tar Interpretation Conflict
Vulnerability summary
CVE-2026-32766 is a medium (CVSS 5.3) Interpretation Conflict vulnerability in astral-sh tokio-tar. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 20-03-2026PublishedVulnerability first disclosed.
- 20-03-2026Last modifiedVulnerability information updated.
Description
astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.
CVSS metrics
9 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- OSV · Crates.ioEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST1.7LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.06 pp
From 0.25% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- mise< 2026.4.15-r0
- pixi< 0.69.0-r0
- uv< 0.10.12-r0
- wasmcloud< 2.0.1-r0
Wolfi3 products
- pixi< 0.69.0-r0
- uv< 0.10.12-r0
- wasmcloud< 2.0.1-r0
Astral1 product
- astral-tokio-tar< 0.6.0
Astral-sh1 product
- tokio-tar< 0.6.0
Crates.Io1 product
- astral-tokio-tar< 0.6.0 | ≥ 0.0.0-0, < 0.6.0
Debian1 product
- rust-astral-tokio-tarAll versions (No fix recorded) | < 0.6.0-1
Ubuntu1 product
- rust-astral-tokio-tarAll versions (No fix recorded)
7 vendors · 12 products
References
10 links- github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54X Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
- github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52X Refsource MISCREPORTFIXWEBPatch
