{
 "item_id": "ker-tar_pax",
 "kernel": "tar_pax",
 "advisory": "RUSTSEC-2026-0145",
 "crate": "astral-tokio-tar",
 "pre_version": "0.6.1",
 "post_version": "0.6.2",
 "advisory_url": "https://github.com/astral-sh/tokio-tar/pull/82",
 "title": "PAX Header Desynchronization in astral-tokio-tar",
 "source_file": "src/archive.rs",
 "function": "apply_pax",
 "signature": "pub fn apply_pax(entry_type: u8, has_pax: bool) -> bool",
 "spec_doc": "PAX extended-header data describes the next file entry. Returns whether pending PAX data must be applied to a header of the given type byte: only for real entries, never for GNU long-name 'L', long-link 'K', PAX local 'x' or global 'g' headers.",
 "bug_class": "logic",
 "fidelity": "verbatim_logic",
 "extraction_note": "src/archive.rs: PAX data applied to extension headers (desynchronisation)",
 "witness_args": "b'L', true",
 "labels": {
  "buggy": "astral-tokio-tar@0.6.1",
  "reference": "astral-tokio-tar@0.6.2"
 }
}