8.1

CVE-2026-33055: alexcrichton tar-rs Type Confusion

CVSS: 8.1v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-33055DEBIAN-CVE-2026-33055CGA-36xh-pjhr-jwhc
Published 20-03-2026Last modified 20-03-2026
Open JSON

Vulnerability summary

CVE-2026-33055 is a high (CVSS 8.1) Type Confusion vulnerability in alexcrichton tar-rs. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.1/10
010
High · v3.1 (NVD)
EPSS score
0.50%
0%100%
Low · +0.10 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-JH5J-68C4-238R

Timeline

  1. 20-03-2026
    PublishedVulnerability first disclosed.
  2. 20-03-2026
    Last modifiedVulnerability information updated.

Description

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.50%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

+0.10 pp

From 0.40% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.50%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Tar Rs

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard15 products
  • bootc-binary< 1.10.0-r3
  • buck2< 20260315-r4
  • cargo-c< 0.10.21-r3
  • deno< 2.7.8-r0
  • fnm< 1.39.0-r2
Wolfi11 products
  • buck2< 20260315-r4
  • cargo-c< 0.10.21-r3
  • deno< 2.7.8-r0
  • pixi< 0.66.0-r3
  • qdrant< 1.17.0-r7
Debian2 products
  • rust-tarAll versions (No fix recorded) | < 0.4.45-1
  • rustcAll versions (No fix recorded) | < 1.85.1+dfsg1-1+deb13u1 | < 1.92.0+dfsg1-2
Alexcrichton1 product
Crates.Io1 product
  • tar< 0.4.45 | ≥ 0.0.0-0, < 0.4.45
Ubuntu1 product
  • rust-tarAll versions (No fix recorded)

6 vendors · 31 products

References

12 links
Show all 12 references