# CVE-2026-33055: tar-rs incorrectly ignores PAX size headers if header size is nonzero

CVE-2026-33055 is fixed in 44 products on 1 platform, first by DEBIAN-CVE-2026-33055, released March 20, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-33055
- Priority: High
- CVSS: 8.1 (Moderate)
- EPSS: 0.0042
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 20, 2026
- Weakness: Access of Resource Using Incompatible Type ('Type Confusion')
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33055

## Description

tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. This is almost the inverse of the astral-tokio-tar issue. Any discrepancy in how tar parsers honor file size can be used to create archives that appear differently when unpacked by different archivers. In this case, the tar-rs (Rust tar) crate is an outlier in checking for the header size - other tar parsers (including e.g. Go archive/tar) unconditionally use the PAX size override. This can affect anything that uses the tar crate to parse archives and expects to have a consistent view with other parsers. This issue has been fixed in version 0.4.45.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | below amzn 2023 | 0.11.0-1.amzn2023.0.3 | [ALAS2023-2026-1567](https://patchblox.com/security/data/fix/linux/alas2023-2026-1567.md) | Apr 13, 2026 |
| Linux | below-debuginfo amzn 2023 | 0.11.0-1.amzn2023.0.3 | [ALAS2023-2026-1567](https://patchblox.com/security/data/fix/linux/alas2023-2026-1567.md) | Apr 13, 2026 |
| Linux | cargo amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | cargo-c amzn 2023 | 0.10.19-1.amzn2023.0.2 | [ALAS2023-2026-1566](https://patchblox.com/security/data/fix/linux/alas2023-2026-1566.md) | Apr 13, 2026 |
| Linux | cargo-c-debuginfo amzn 2023 | 0.10.19-1.amzn2023.0.2 | [ALAS2023-2026-1566](https://patchblox.com/security/data/fix/linux/alas2023-2026-1566.md) | Apr 13, 2026 |
| Linux | cargo-debuginfo amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | clamav1.5 amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-data amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-debuginfo amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-debugsource amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-devel amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-doc amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-filesystem amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-freshclam amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-freshclam-debuginfo amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-lib amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-lib-debuginfo amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-milter amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamav1.5-milter-debuginfo amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamd1.5 amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clamd1.5-debuginfo amzn 2023 | 1.5.1-1.amzn2023.0.5 | [ALAS2023-2026-1565](https://patchblox.com/security/data/fix/linux/alas2023-2026-1565.md) | Apr 13, 2026 |
| Linux | clippy amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | clippy-debuginfo amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-analyzer amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-analyzer-debuginfo amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-below-debugsource amzn 2023 | 0.11.0-1.amzn2023.0.3 | [ALAS2023-2026-1567](https://patchblox.com/security/data/fix/linux/alas2023-2026-1567.md) | Apr 13, 2026 |
| Linux | rust-cargo-c-debugsource amzn 2023 | 0.10.19-1.amzn2023.0.2 | [ALAS2023-2026-1566](https://patchblox.com/security/data/fix/linux/alas2023-2026-1566.md) | Apr 13, 2026 |
| Linux | rust-debugger-common amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-debuginfo amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-debugsource amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-doc amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-gdb amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-lldb amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-src amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-std-static amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-std-static-wasm32-unknown-unknown amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-std-static-wasm32-wasip1 amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-tar Debian 14 | 0.4.45-1 | [DEBIAN-CVE-2026-33055](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33055.md) | Mar 20, 2026 |
| Linux | rust-toolset amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rust-toolset-srpm-macros amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rustc Debian 13.5 (trixie) | 1.85.1+dfsg1-1+deb13u1 | [DEBIAN-CVE-2026-33055](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33055.md) | Mar 20, 2026 |
| Linux | rustc Debian 14 | 1.92.0+dfsg1-2 | [DEBIAN-CVE-2026-33055](https://patchblox.com/security/data/fix/linux/debian-cve-2026-33055.md) | Mar 20, 2026 |
| Linux | rustfmt amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |
| Linux | rustfmt-debuginfo amzn 2023 | 1.94.0-1.amzn2023.0.2 | [ALAS2023-2026-1568](https://patchblox.com/security/data/fix/linux/alas2023-2026-1568.md) | Apr 13, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.