CVE-2026-32766

CVE-2026-32766 affects astral-tokio-tar versions 0.5.6 and earlier, where the library silently skips malformed PAX extensions in tar archives instead of rejecting them. This low-severity vulnerability (CVSS 1.7) requires a high attack complexity, as exploitation depends on a secondary, vulnerable tar parser misinterpreting the silently skipped extensions, potentially leading to minor integrity issues. The attack vector is network-based, but the specific conditions make it difficult to leverage. There is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are currently absent, further indicating its low profile and minimal immediate threat.