{"action":"Upgrade tar to 0.4.45 or later.","affected":[{"fixed":"0.4.45","introduced":"0.0.0-0"}],"component":"tar","cve_ids":["CVE-2026-33055"],"ecosystem":"crates.io","epss":0.00412,"exploited":false,"fixed_versions":["0.4.45"],"ghsa_id":"GHSA-gchp-q4r4-x4ff","id":"tcs_01M5KFB2GTNJGZPR7SRRDYJ10M","modified_at":"2026-03-23T09:45:06.562240Z","published_at":"2026-03-19T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0068","https://crates.io/crates/tar","https://rustsec.org/advisories/RUSTSEC-2026-0068.html"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0068","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0068"},{"source":"nvd","source_id":"CVE-2026-33055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33055"}],"summary":"tar-rs incorrectly ignores PAX size headers if header size is nonzero"}