Buffer Misapplication in async-tar Library Affects Rust Applications
CVE-2026-53600

6.3MEDIUM

Key Information:

Vendor

Dignifiedquire

Status
Async-tar
Vendor
CVE Published:
2 September 2026

What is CVE-2026-53600?

The async-tar library, utilized for reading and writing tar archives in asynchronous Rust applications, suffers from a vulnerability where a buffered PAX size extension is incorrectly applied to intermediary extension headers instead of the following file entry. This misimplementation can lead to desynchronization issues when parsing tar files, enabling potential exploitation by an attacker to manipulate file entry parsing. The flaw has been corrected in version 0.6.1, which developers are urged to upgrade to for secure operations.

Affected Version(s)

async-tar < 0.6.1

References

https://github.com/dignifiedquire/async-tar/security/advi...
x_refsource_CONFIRM
https://github.com/dignifiedquire/async-tar/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.