Search: CVE-2026-32766

CVE-2026-32766 is a low-severity vulnerability in the astral-tokio-tar Rust library versions prior to 0.6.0. The issue arises from the library silently skipping malformed PAX extensions in tar archives instead of rejecting them. This behavior can enable a parser differential attack when combined with another tar parser that misinterprets these malformed extensions. Exploitation requires a secondary vulnerability in an unrelated tar parser, making this a complex, multi-step attack. No known exploits are currently reported in the wild. The vulnerability affects asynchronous Rust applications using astral-tokio-tar for tar archive processing. It has been fixed in version 0.6.