astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by silently skipping a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. This vulnerability is considered low-severity as it requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version 0.6.0.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-23bb71ea52 advisory.

    Update `rust-astral-tokio-tar` to 0.6.0, fixing CVE-2026-32766. Update `rust-tar` to 0.4.45, fixing     CVE-2026-33056. Update `rust-nix` to [0.31.2](https://github.com/nix-rust/nix/blob/v0.31.2/CHANGELOG.md).
    Update `uv` and `python-uv-build` to [0.10.2](https://github.com/astral-sh/uv/blob/0.10.12/CHANGELOG.md),     rebuilding them with the latest `rust-astral-tokio-tar` and `rust-tar`. Update `python-fastar` to     [0.9.0](https://github.com/DoctorJohn/fastar/releases/tag/v0.9.0), rebuilding it with the lastest `rust-     tar`. Rebuild `maturin` with the latest `rust-tar`.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-d18cf572b8 advisory.

    Update `rust-astral-tokio-tar` to 0.6.0, fixing CVE-2026-32766. Update `rust-tar` to 0.4.45, fixing     CVE-2026-33056. Update `rust-nix` to [0.31.2](https://github.com/nix-rust/nix/blob/v0.31.2/CHANGELOG.md).
    Update `uv` and `python-uv-build` to [0.10.2](https://github.com/astral-sh/uv/blob/0.10.12/CHANGELOG.md),     rebuilding them with the latest `rust-astral-tokio-tar` and `rust-tar`. Update `python-fastar` to     [0.9.0](https://github.com/DoctorJohn/fastar/releases/tag/v0.9.0), rebuilding it with the lastest `rust-     tar`. Rebuild `maturin` with the latest `rust-tar`.

    ----

    Update to [0.9.0](https://github.com/DoctorJohn/fastar/releases/tag/v0.9.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-e22a7dbf2d advisory.

    Update `rust-astral-tokio-tar` to 0.6.0, fixing CVE-2026-32766. Update `rust-tar` to 0.4.45, fixing     CVE-2026-33056. Update `rust-nix` to [0.31.2](https://github.com/nix-rust/nix/blob/v0.31.2/CHANGELOG.md).
    Update `uv` and `python-uv-build` to [0.10.2](https://github.com/astral-sh/uv/blob/0.10.12/CHANGELOG.md),     rebuilding them with the latest `rust-astral-tokio-tar` and `rust-tar`. Update `python-fastar` to     [0.9.0](https://github.com/DoctorJohn/fastar/releases/tag/v0.9.0), rebuilding it with the lastest `rust-     tar`. Rebuild `maturin` with the latest `rust-tar`.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-c6c01a71f2 advisory.

    Update `rust-astral-tokio-tar` to 0.6.0, fixing CVE-2026-32766. Update `rust-tar` to 0.4.45 to 0.4.45,     fixing CVE-2026-33056. Update `uv` and `python-uv-build` to [0.10.2](https://github.com/astral-     sh/uv/blob/0.10.12/CHANGELOG.md, rebuilding them with the latest `rust-astral-tokio-tar` and `rust-tar`.
    Rebuild `python-fastar` and `maturin` with the latest `rust-tar`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier,     malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather     than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for     example by silently skipping a malformed GNU long link extension so that a subsequent parser would     misinterpret the extension. In practice, exploiting this behavior in astral-tokio-tar requires a secondary     misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets     them rather than skipping or erroring on them. This vulnerability is considered low-severity as it     requires a separate vulnerability against any unrelated tar parser. This issue has been fixed in version     0.6.0. (CVE-2026-32766)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
304240	Fedora 42 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-23bb71ea52)	Nessus	Fedora Local Security Checks	medium
304145	Fedora 43 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-d18cf572b8)	Nessus	Fedora Local Security Checks	medium
304144	Fedora 44 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-e22a7dbf2d)	Nessus	Fedora Local Security Checks	medium
303259	Fedora 45 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-c6c01a71f2)	Nessus	Fedora Local Security Checks	medium
303172	Linux Distros Unpatched Vulnerability : CVE-2026-32766	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-32766

medium

Tenable Plugins

medium

medium

medium

medium

medium