CVE-2026-32288 Unbounded allocation for old GNU sparse in archive/tar

CVE-2026-33055 tar-rs incorrectly ignores PAX size headers if header size is nonzero

CVE-2026-33056 tar-rs: unpack_in can chmod arbitrary directories by following symlinks