Astral‑tokio‑tar’s tar archive parser silently ignores malformed PAX extensions in versions 0.5.6 and earlier. This silent skipping, rather than rejecting them, could become part of a parser differential attack. If an adversary supplies an archive that contains malformed GNU “long link” PAX entries, the tokio‑tar library will drop those entries and leave them hidden. A second, unrelated tar parser that does not share this silent‑skip behaviour may still interpret the malformed entries, causing that parser to misread or misinterpret the archive, potentially leading to unexpected behaviour or security holes. The vulnerability is classified as low‑severity because it requires a separate flaw in another, unrelated tar parser for exploitable impact.

The affected product is astral‑sh:tokio‑tar, a Rust tar archive library. Any installation using version 0.5.6 or earlier is vulnerable. The issue was corrected in version 0.6.0. No other versions are listed as impacted.

The CVSS score is 1.7, indicating a very low base severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, further suggesting low exploitation likelihood. Exploitation requires a second, malicious tar parser that inadequately validates PAX extensions, which is uncommon. Therefore the overall risk is considered low but still recommend prompt mitigation.