Stream: git-wasmtime

Topic: wasmtime / issue #12829 RUSTSEC-2026-0068: tar-rs incorre...

Wasmtime GitHub notifications bot (Mar 24 2026 at 00:13):

github-actions[bot] opened issue #12829:

tar-rs incorrectly ignores PAX size headers if header size is nonzero

Details
Package	tar
Version	0.4.41
Date	2026-03-19
Patched versions	>=0.4.45

Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX
size header in cases where the base header size is nonzero.

As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar]
project was changed to correctly honor PAX size headers in the case where it
was different from the base header. This is almost the inverse of the
astral-tokio-tar issue.

Any discrepancy in how tar parsers honor file size can be used to create
archives that appear differently when unpacked by different archivers. In this
case, the tar-rs (Rust tar) crate is an outlier in checking for the header size
— other tar parsers (including e.g. Go [archive/tar][go-tar]) unconditionally
use the PAX size override. This can affect anything that uses the tar crate to
parse archives and expects to have a consistent view with other parsers.

This issue has been fixed in version 0.4.45.

[astral-cve]: https://www.cve.org/CVERecord?id=CVE-2025-62518
[astral-tokio-tar]: https://github.com/astral-sh/tokio-tar
[go-tar]: https://pkg.go.dev/archive/tar

See advisory page for additional details.

Wasmtime GitHub notifications bot (Mar 25 2026 at 00:22):

pchickey closed issue #12829:

tar-rs incorrectly ignores PAX size headers if header size is nonzero

Details
Package	tar
Version	0.4.41
Date	2026-03-19
Patched versions	>=0.4.45

Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX
size header in cases where the base header size is nonzero.

As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar]
project was changed to correctly honor PAX size headers in the case where it
was different from the base header. This is almost the inverse of the
astral-tokio-tar issue.

Any discrepancy in how tar parsers honor file size can be used to create
archives that appear differently when unpacked by different archivers. In this
case, the tar-rs (Rust tar) crate is an outlier in checking for the header size
— other tar parsers (including e.g. Go [archive/tar][go-tar]) unconditionally
use the PAX size override. This can affect anything that uses the tar crate to
parse archives and expects to have a consistent view with other parsers.

This issue has been fixed in version 0.4.45.

[astral-cve]: https://www.cve.org/CVERecord?id=CVE-2025-62518
[astral-tokio-tar]: https://github.com/astral-sh/tokio-tar
[go-tar]: https://pkg.go.dev/archive/tar

See advisory page for additional details.

Last updated: Apr 12 2026 at 23:10 UTC