CVE-2026-53600: CWE-20: Improper Input Validation in dignifiedquire async-tar
Description
async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header (a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because poll_next_raw (src/archive.rs) threads the buffered PAX records into the size computation of whatever raw header it reads next — and that header can be an intermediary L — the stream cursor is advanced by an attacker-chosen amount when the L body is consumed. The parser then desyncs relative to a POSIX-correct tar parser (e.g. GNU tar), reading subsequent bytes at the wrong block boundary. This issue has been patched in version 0.6.1.
CVSS v4.0
Score 6.3medium
Affected software
dignifiedquire
async-tar
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The async-tar library for async Rust incorrectly handles buffered PAX size extensions by applying them to intermediary extension headers (such as GNU longname L, longlink K, or PAX x/g headers) instead of the subsequent file entry as mandated by POSIX. This misapplication causes the stream cursor to advance by an attacker-controlled amount when processing the L body, leading to desynchronization of the parser with respect to POSIX-compliant tar parsers. This vulnerability affects versions prior to 0.6.1 and has been patched in version 0.6.1.
Potential Impact
The improper input validation and parsing desynchronization can cause the async-tar parser to read subsequent bytes at incorrect block boundaries. This may lead to incorrect processing of tar archives, potentially causing denial of service or other unexpected behavior when handling crafted tar files. No evidence of active exploitation is reported.
Mitigation Recommendations
Upgrade async-tar to version 0.6.1 or later, where this issue has been patched. No other mitigation or temporary fix is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-09T19:39:52.404Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a984d61acd9273b4973eaa4
Added to database: 09/02/2026, 16:22:57 UTC
Last enriched: 09/07/2026, 13:27:45 UTC
Last updated: 10/17/2026, 06:48:18 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.