PT-2026-26570 · Tar-Rs · Tar-Rs

Xokdvium · Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-33055

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions tar-rs versions 0.4.44 and below

Description tar-rs, a Rust library for reading and writing tar archives, contains a flaw in its handling of PAX size headers. Specifically, versions 0.4.44 and below have conditional logic that skips the PAX size header when the base header size is non-zero. This discrepancy in how tar parsers handle file sizes can be exploited to create archives that appear different when unpacked by different archivers. The tar-rs crate is an exception in checking the header size, while other tar parsers, such as Go's archive/tar, unconditionally use the PAX size override. This issue can affect any application using the tar-rs crate to parse archives and expecting consistency with other parsers. A proof-of-concept (PoC) demonstrates the potential to smuggle symlinks into the registry, bypassing security checks in certain scenarios.

Recommendations Update to version 0.4.45 or later.

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2026-33055

GHSA-GCHP-Q4R4-X4FF

RUSTSEC-2026-0068

Affected Products

Tar-Rs

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33055.json · Exploit
• https://github.com/alexcrichton/tar-rs/commit/de1a5870e603758f430073688691165f21a33946 · Patch
• https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-gchp-q4r4-x4ff · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33055 · Security Note
• https://ubuntu.com/security/CVE-2026-33055 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33055 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33055 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33055 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gchp-q4r4-x4ff · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0068 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33055 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33055 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-62518 · Security Note
• https://github.com/composefs/tar-rs/security/advisories/GHSA-gchp-q4r4-x4ff · Note
• https://github.com/alexcrichton/tar-rs · Note