CVE-2026-32766

A flaw was found in astral-tokio-tar, a software component for handling tar archives. This flaw causes malformed PAX (Portable Archive eXchange) extensions within an archive to be silently ignored. An attacker could leverage this to create a specially crafted archive that, when processed by astral-tokio-tar and then by another vulnerable tar program, could be interpreted differently. This 'parser differential' might lead to misinterpretation of the archive's contents, but it requires a separate vulnerability in the secondary tar program for exploitation.

This is a LOW impact flaw in astral-tokio-tar where malformed PAX extensions are silently ignored, potentially leading to a parser differential. Exploitation requires a secondary, vulnerable tar program that misinterprets these extensions. Red Hat products are only affected if they integrate astral-tokio-tar with such a vulnerable secondary parser.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.