Security advisory for Cargo (CVE-2026-33056 in tar crate)

Image: Primary

Published Friday, June 26, 2026 · 6:22 PM EDT

The Rust Security Response Team was notified of a vulnerability in the third-party tar crate used by Cargo to extract packages during a build. The vulnerability, tracked as CVE-2026-33056, allows a malicious crate to change the permissions on arbitrary directories on the filesystem when Cargo extracts it during a build. For users of the public crates.io registry, a change was deployed on March 13th to prevent uploading crates exploiting this vulnerability. An audit of all crates ever published confirmed that none on crates.io are exploiting it. Users of alternate registries should contact the vendor of their registry to verify whether they are affected. The Rust team will release Rust 1.94.1 on March 26th, 2026, updating to a patched version of the tar crate along with other non-security fixes for the Rust toolchain. This release will not protect users of older versions of Cargo using alternate registries. Sergei Zimmerman discovered the tar crate vulnerability and notified the Rust project ahead of time. William Woodruff directly assisted the crates.io team with the mitigations. The advisory also credits Eric Huss for patching Cargo, Tobias Bieniek, Adam Harvey and Walter Pearce for patching crates.io and analyzing crates, Emily Albini and Josh Stone for coordinating the response, and Emily Albini for writing the advisory.

Sources

The Rust Security Response Team

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Rust Security Response Team and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Capital Products

U.S. Series A funding reaches $42 billion as deal counts hold steady

U.S. startups raised $42 billion in Series A funding through October 2026, up roughly 60% year over year, while deal counts remained on pace with recent years, Crunchbase data shows.

Products

Ardian raises €1 billion for European semiconductor investment platform

Ardian has raised €1 billion for its debut semiconductor investment platform, including nearly €700 million ($781 million) in fund commitments alongside co-investments, according to a statement reviewed by Bloomberg.

Capital

Nominal raises $240 million at a $3 billion valuation

Nominal has raised $240 million at a $3 billion valuation, triple its valuation in a funding round earlier this year, Bloomberg reports. The startup builds software to make manufacturing more efficient.

Capital Products

Onodrim raises $300M to acquire European defence and industrial suppliers

Amsterdam-based Onodrim Industries has raised $300M in a round led by Lux Capital, valuing the defence group at $1.3bn, the company said Monday. Other investors include General Catalyst, Lakestar and Altimeter. The financing follows its €40M seed round in February.

Capital

SRTD Biotech raises €31.5 million for targeted RNA therapies

SRTD Biotech has completed an oversubscribed €31.5 million seed financing to develop RNA therapies designed to act selectively inside diseased cells. Mérieux Equity Partners led the round, with NRW.BANK and Boehringer Ingelheim Venture Fund joining as co-leads.

Ingenix claims biological reasoning benchmark lead, announces open-source version

Ingenix says its 9-billion-parameter Thalamus Reasoning model ranks first among 29 models on LongevityBench, which tests language models on cellular aging research.