diff --git a/swh/icinga_plugins/tests/test_vault.py b/swh/icinga_plugins/tests/test_vault.py
--- a/swh/icinga_plugins/tests/test_vault.py
+++ b/swh/icinga_plugins/tests/test_vault.py
@@ -408,7 +408,7 @@
     )
 
     assert result.output == (
-        "VAULT CRITICAL - Error while reading tarball: not a gzip file\n"
+        "VAULT CRITICAL - ReadError while reading tarball: not a gzip file\n"
         "| 'total_time' = 20.00s\n"
     )
     assert result.exit_code == 2, result.output
@@ -454,6 +454,50 @@
     assert result.exit_code == 2, result.output
 
 
+def test_vault_empty_tarball(requests_mock, mocker, mocked_time):
+    fd = io.BytesIO()
+    with tarfile.open(fileobj=fd, mode="w:gz"):
+        pass
+    tarball = fd.getvalue()
+    print(tarball)
+
+    scenario = WebScenario()
+
+    scenario.add_step("get", url_api, {}, status_code=404)
+    scenario.add_step("post", url_api, response_pending)
+    scenario.add_step("get", url_api, response_pending)
+    scenario.add_step("get", url_api, response_done)
+    scenario.add_step(
+        "get", url_fetch, tarball, headers={"Content-Type": "application/gzip"},
+    )
+
+    scenario.install_mock(requests_mock)
+
+    get_storage_mock = mocker.patch("swh.icinga_plugins.vault.get_storage")
+    get_storage_mock.side_effect = FakeStorage
+
+    result = invoke(
+        [
+            "check-vault",
+            "--swh-web-url",
+            "mock://swh-web.example.org",
+            "--swh-storage-url",
+            "foo://example.org",
+            "directory",
+        ],
+        catch_exceptions=True,
+    )
+
+    # This error message will need to be updated when https://bugs.python.org/issue46922
+    # is resolved.
+    assert result.output == (
+        "VAULT CRITICAL - StreamError while reading tarball (empty file?): "
+        "seeking backwards is not allowed\n"
+        "| 'total_time' = 20.00s\n"
+    )
+    assert result.exit_code == 2, result.output
+
+
 def test_vault_no_fetch_url(requests_mock, mocker, mocked_time):
     scenario = WebScenario()
 
diff --git a/swh/icinga_plugins/vault.py b/swh/icinga_plugins/vault.py
--- a/swh/icinga_plugins/vault.py
+++ b/swh/icinga_plugins/vault.py
@@ -125,7 +125,7 @@
                 return 2
 
             try:
-                with tarfile.open(fileobj=fetch_response.raw, mode="r:gz") as tf:
+                with tarfile.open(fileobj=fetch_response.raw, mode="r|gz") as tf:
                     # Note that we are streaming the tarfile from the network,
                     # so we are allowed at most one pass on the tf object;
                     # and the sooner we close it the better.
@@ -144,7 +144,23 @@
             except tarfile.ReadError as e:
                 self.print_result(
                     "CRITICAL",
-                    f"Error while reading tarball: {e}",
+                    f"ReadError while reading tarball: {e}",
+                    total_time=total_time,
+                )
+                return 2
+            except tarfile.StreamError as e:
+                if e.args[0] == "seeking backwards is not allowed":
+                    # Probably https://bugs.python.org/issue46922
+                    self.print_result(
+                        "CRITICAL",
+                        f"StreamError while reading tarball (empty file?): {e}",
+                        total_time=total_time,
+                    )
+                    return 2
+
+                self.print_result(
+                    "CRITICAL",
+                    f"StreamError while reading tarball: {e}",
                     total_time=total_time,
                 )
                 return 2