CVE-2026-53600 Overview
CVE-2026-53600 is an input validation flaw [CWE-20] in async-tar, a tar archive reading and writing library for asynchronous Rust. Versions prior to 0.6.1 mis-apply a buffered PAX size extension to an intermediary extension header instead of to the next file entry. The affected intermediary headers include GNU longname (L), GNU longlink (K), and PAX (x/g) records. Attackers can craft a tar archive that desynchronizes the parser relative to POSIX-compliant tools such as GNU tar, causing subsequent bytes to be read at the wrong block boundary. The maintainers patched the issue in version 0.6.1.
Critical Impact
A malicious tar archive can force async-tar to interpret file contents at attacker-chosen offsets, enabling parser confusion between async-tar and POSIX-correct tar implementations.
Affected Products
- async-tar Rust crate versions prior to 0.6.1
- Applications embedding async-tar for asynchronous tar archive processing
- Downstream Rust projects transitively depending on vulnerable versions
Discovery Timeline
- 2026-09-02 - CVE-2026-53600 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-53600
Vulnerability Analysis
The defect resides in poll_next_raw within src/archive.rs. POSIX specifies that a PAX extended-header record set must describe the next file entry, never an intervening extension header. The async-tar parser instead threads buffered PAX records into the size computation for whatever raw header it reads next. When that subsequent header is an intermediary GNU longname (L), longlink (K), or PAX (x/g) header, the buffered size extension is applied to the wrong record.
As a result, the stream cursor advances by an attacker-controlled amount when the intermediary body is consumed. The parser then desynchronizes from a POSIX-correct tar parser such as GNU tar. Downstream code reads subsequent bytes at the wrong 512-byte block boundary, producing divergent views of the same archive across tools.
Root Cause
The root cause is improper input validation of tar header sequencing. The parser fails to enforce the POSIX rule that a PAX size override applies only to a following file entry, not to an intermediate extension header. State tracking for the buffered PAX record persists incorrectly across intermediary header reads.
Attack Vector
An attacker delivers a crafted tar archive to any application that uses async-tar for extraction or inspection. Exploitation requires only that the target process the archive; no authentication or user interaction is needed. The result is parser divergence, which attackers can leverage to smuggle files past scanners, antivirus, or policy engines that use a different tar implementation.
Refer to the GitHub Security Advisory GHSA-35rm-7j9c-2f7m for the maintainer's technical write-up.
Detection Methods for CVE-2026-53600
Indicators of Compromise
- Tar archives containing PAX x or g records with a size extension followed immediately by a GNU L, K, or additional PAX header rather than a normal file entry.
- Divergent extraction results between async-tar and GNU tar when processing the same archive.
- Unexpected file entries appearing after async-tar extraction that do not appear in a POSIX-compliant listing, or vice versa.
Detection Strategies
- Perform differential extraction: process incoming archives with both async-tar and a reference POSIX parser, and alert on mismatched file lists or byte sizes.
- Inventory Rust project dependencies for async-tar versions below 0.6.1 using cargo tree or Software Bill of Materials (SBOM) tooling.
- Inspect tar streams for PAX size records that are not immediately followed by a standard file header block.
Monitoring Recommendations
- Log tar extraction operations in services that accept user-supplied archives, including artifact registries and CI pipelines.
- Monitor for archive processing errors or anomalous file counts emitted by services built on async-tar.
- Track dependency updates across build systems to confirm remediation propagation.
How to Mitigate CVE-2026-53600
Immediate Actions Required
- Upgrade async-tar to version 0.6.1 or later in all direct and transitive dependencies.
- Rebuild and redeploy any Rust binaries that link against the vulnerable crate.
- Audit ingestion pipelines that accept untrusted tar archives and gate them behind the patched version.
Patch Information
The fix is available in async-tar v0.6.1. The patched release corrects poll_next_raw so buffered PAX size extensions apply only to the next file entry, matching POSIX semantics.
Workarounds
- Reject or quarantine tar archives from untrusted sources until the upgrade is applied.
- Validate archives with a POSIX-compliant tar implementation before passing them to async-tar consumers.
- Restrict archive-processing services to authenticated internal callers where feasible.
# Update the dependency in Cargo.toml to the patched version
cargo update -p async-tar --precise 0.6.1
cargo tree -i async-tar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
