{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/vex/2026/cve-2026-53655-els_os-tuxcare9_8esu.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-15T20:29:31Z",
      "generator": {
        "date": "2026-10-15T20:29:31Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-53655-ELS_OS-TUXCARE9.8ESU",
      "initial_release_date": "2026-06-22T16:16:00Z",
      "revision_history": [
        {
          "date": "2026-06-22T16:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-06T12:48:43Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-10-15T20:29:31Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2026-53655"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "AlmaLinux 9.8",
                "product": {
                  "name": "AlmaLinux 9.8",
                  "product_id": "AlmaLinux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "AlmaLinux"
          }
        ],
        "category": "vendor",
        "name": "AlmaLinux OS Foundation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Rocky Linux 9.8",
                "product": {
                  "name": "Rocky Linux 9.8",
                  "product_id": "Rocky Linux-9.8",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Rocky Linux"
          }
        ],
        "category": "vendor",
        "name": "Rocky Linux"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
                  "product_id": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/tar@1.34-13.el9_8.tuxcare.els1?arch=aarch64&epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
                  "product_id": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/tar@1.34-13.el9_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.34-13.el9_8.tuxcare.els1.i686",
                "product": {
                  "name": "tar-2:1.34-13.el9_8.tuxcare.els1.i686",
                  "product_id": "tar-2:1.34-13.el9_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/tar@1.34-13.el9_8.tuxcare.els1?arch=i686&epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.tuxcare.els1.i686 as a component of AlmaLinux 9.8",
          "product_id": "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.i686"
        },
        "product_reference": "tar-2:1.34-13.el9_8.tuxcare.els1.i686",
        "relates_to_product_reference": "AlmaLinux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.aarch64"
        },
        "product_reference": "tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.x86_64"
        },
        "product_reference": "tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Rocky Linux-9.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.34-13.el9_8.tuxcare.els1.i686 as a component of Rocky Linux 9.8",
          "product_id": "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.i686"
        },
        "product_reference": "tar-2:1.34-13.el9_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Rocky Linux-9.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53655",
      "notes": [
        {
          "category": "description",
          "text": "node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.",
          "title": "Statement"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
          "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.i686",
          "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
          "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
          "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.i686",
          "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-53655"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh"
        }
      ],
      "release_date": "2026-06-22T16:16:00Z",
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        },
        {
          "category": "impact",
          "date": "2026-10-15T17:38:07.067164Z",
          "details": "CVE-2026-53655 affects node-tar, the Node.js tar implementation, which is not part of the tar package for TuxCare 9.8 ESU. The tar package shipped for this platform does not contain the vulnerable code.",
          "product_ids": [
            "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
            "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.i686",
            "AlmaLinux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.x86_64",
            "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.aarch64",
            "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.i686",
            "Rocky Linux-9.8:tar-2:1.34-13.el9_8.tuxcare.els1.x86_64"
          ]
        }
      ]
    }
  ]
}