CVE-2026-53600

Name of the Vulnerable Software and Affected Versions async-tar versions 0.6.0 and earlier

Description async-tar mis-applies a buffered PAX size extension to an intermediary extension header (such as a GNU longname L, a GNU longlink K, or a PAX x/g header) instead of applying it to the subsequent file entry. This occurs because the poll next raw() function in src/archive.rs incorporates buffered PAX records into the size computation of the next raw header it reads, regardless of whether that header is itself an extension.

This behavior allows an attacker to manipulate the stream cursor by providing a specific x to L sequence, causing the parser to desynchronize relative to POSIX-compliant parsers like GNU tar. This desynchronization enables content or entry smuggling, where a security scanner using a reference parser may see benign data while async-tar extracts a different, potentially malicious file (e.g., an executable script) from the same archive.

Recommendations Update async-tar to version 0.6.1. As a temporary mitigation, restrict the extraction of tar archives from untrusted sources using the poll next raw() function in src/archive.rs until the update is applied.