{"action":"Upgrade astral-tokio-tar to 0.6.0 or later.","affected":[{"fixed":"0.6.0","introduced":"0.0.0-0"}],"component":"astral-tokio-tar","cve_ids":["CVE-2026-32766"],"ecosystem":"crates.io","epss":0.00253,"exploited":false,"fixed_versions":["0.6.0"],"ghsa_id":"GHSA-6gx3-4362-rf54","id":"tcs_01M5KFB22BN08WXSA60QQASNBV","modified_at":"2026-03-23T09:56:17.487066Z","published_at":"2026-03-17T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0066","https://crates.io/crates/astral-tokio-tar","https://rustsec.org/advisories/RUSTSEC-2026-0066.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0066","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0066"},{"source":"nvd","source_id":"CVE-2026-32766","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32766"}],"summary":"Insufficient validation of PAX extensions during extraction"}