CVE-2026-33055

Katalog CVE

CVSS 8.1 · High EPSS 0,48%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada alexcrichton tar-rs. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-gchp-q4r4-x4ff exploit · advisory vendor
• https://github.com/alexcrichton/tar-rs/commit/de1a5870e603758f430073688691165f21a33946 patch
• https://www.cve.org/CVERecord?id=CVE-2025-62518 advisory pihak ketiga