RUSTSEC-2026-0440 json
`astral-tokio-tar` is unmaintained
published 2026-11-03 5 d ago modified 2026-11-05 3 d ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Astral ended maintenance of `astral-tokio-tar` on November 3, 2026. All versions of the crate are deprecated and unmaintained.
For strict tar encoding and decoding, Astral recommends [`tar-codec`] as a possible replacement.
[0.7.1 release]: https://github.com/astral-sh/tokio-tar/releases/tag/v0.7.1 [`tar-codec`]: https://crates.io/crates/tar-codec
Patch / fix
- github.com/astral-sh/tokio-tar#130 pull request
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | astral-tokio-tar | >=0.0.0-0 |
no fix listed |
References
Sources
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.