crates.io/async-tar CVE-2026-53600: medium 6.3, EPSS 0.45%
async-tar PAX extension-header desync enables tar entry/content smuggling
Action: Upgrade async-tar to 0.6.1 or later.
cargo update -p async-tar --precise 0.6.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.1 | - |
Fixed versions
| 0.6.1 |
Sources
- osv: GHSA-35rm-7j9c-2f7m
- nvd: CVE-2026-53600
- https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m
- https://github.com/dignifiedquire/async-tar
CVE-2026-53600 · published · modified · JSON