{"items":[{"id":"NVI-00018611","kind":"vulnerability","title":"tar has a PAX header desynchronization issue","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3pv8-6f4r-ffg2"],"plain_summary":"GitHub lists this reviewed advisory for tar. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4448a4757e8a53015aadc925c63cdb45"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4448a4757e8a53015aadc925c63cdb45","url":"https://github.com/advisories/GHSA-3pv8-6f4r-ffg2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3pv8-6f4r-ffg2","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:53:14.635Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4448a4757e8a53015aadc925c63cdb45"],"technology":"tar","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen a tar stream contains multiple \"header\" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.\n\nPer POSIX pax, this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the \"pax Header Block\" section for the specific prescription there.\n\nAs a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header's `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers.\n\n### PoC\n\nThis tar (zipped for size) demonstrates the desynchronization: with `tar tvf`:\n\n```\n% tar tvf tests/archives/pax-overrides-extension-heade","public_affected_ranges":["<= 0.4.45"]}],"null_published_at":"2026-11-07T07:07:39.862Z","source_updated_at":"2026-05-29T19:16:13.000Z","source_disclosed_at":"2026-05-29T19:16:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:53:14.635Z"}],"next_cursor":null,"snapshot_revision":"42594"}