372473 matches found
RUSTSEC-2026-0397 `OutBuffer::around_pos` exposes uninitialized memory
OutBuffer::aroundpos accepted a position past the initialized length of a Vec. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that position. The flaw was corrected by zero-fillin...
aedat (>=1.2.3, <=1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +528 more potentially affected by unknown CVE via zstd-safe (>=4.1.0+zstd.1.5.0, <=7.2.4)
zstd-safe CARGO version =4.1.0+zstd.1.5.0, =1.2.3, =0.4.0, =0.1.25, =0.1.12, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0403...
box-bin (0.3.1), ps-compress (>=0.1.0-17, <=0.1.0-18) potentially affected by unknown CVE via zstd-safe (7.2.4)
zstd-safe CARGO version 7.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on zstd-safe and may be impacted: - box-bin 0.3.1 - ps-compress =0.1.0-17, =0.1.0-18 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0398...
aedat (>=1.2.3, <=1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +544 more potentially affected by unknown CVE via zstd-safe (>=3.0.1+zstd.1.4.9, <=7.2.4)
zstd-safe CARGO version =3.0.1+zstd.1.4.9, =1.2.3, =0.4.0, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0400...
RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame
When a multithreaded frame zstdmt feature, CParameter::NbWorkers is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the...
accesskit_atspi_common (>=0.1.1, <=0.9.1), accesskit_unix (>=0.1.0, <=0.11.1) +227 more potentially affected by unknown CVE via zvariant_derive (>=2.2.0, <=5.15.1)
zvariantderive CARGO version =2.2.0, =0.1.1, =0.1.0, =0.8.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.0.0, =0.1.0, =0.3.4 - benchscraper 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0372...
accesskit_atspi_common (>=0.1.1, <=0.9.1), accesskit_unix (>=0.1.0, <=0.11.1) +227 more potentially affected by unknown CVE via zvariant (>=2.1.0, <=5.15.1)
zvariant CARGO version =2.1.0, =0.1.1, =0.1.0, =0.8.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.0.0, =0.1.0, =0.3.4 - benchscraper 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0370...
aedat (>=1.2.3, <=1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +528 more potentially affected by unknown CVE via zstd-safe (>=4.1.0+zstd.1.5.0, <=7.2.4)
zstd-safe CARGO version =4.1.0+zstd.1.5.0, =1.2.3, =0.4.0, =0.1.25, =0.1.12, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0397...
aedat (1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +455 more potentially affected by unknown CVE via zstd-safe (>=4.1.4+zstd.1.5.2, <=7.2.4)
zstd-safe CARGO version =4.1.4+zstd.1.5.2, =0.4.0, =0.1.32, =0.1.20, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 - archive-rs 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0402...
box-bin (0.3.1), ps-compress (>=0.1.0-17, <=0.1.0-18) potentially affected by unknown CVE via zstd-safe (7.2.4)
zstd-safe CARGO version 7.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on zstd-safe and may be impacted: - box-bin 0.3.1 - ps-compress =0.1.0-17, =0.1.0-18 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0405...
aedat (>=1.2.3, <=1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +544 more potentially affected by unknown CVE via zstd-safe (>=3.0.1+zstd.1.4.9, <=7.2.4)
zstd-safe CARGO version =3.0.1+zstd.1.4.9, =1.2.3, =0.4.0, =0.1.13, =0.1.0, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0399...
accesskit_atspi_common (>=0.1.1, <=0.9.1), accesskit_unix (>=0.1.0, <=0.11.1) +194 more potentially affected by unknown CVE via zbus_names (>=1.1.0, <=4.3.5)
zbusnames CARGO version =1.1.0, =0.1.1, =0.1.0, =0.8.0, =0.2.0-alpha, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.0.0, =0.1.0, =0.0.1, =0.1.14 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0371...
RUSTSEC-2026-0400 Use-after-free of a dictionary after a one-shot call on a context with an open stream
The one-shot DCtx and CCtx methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as decompressusingdict could leave the context pointing at the dictionary borrowed for that call, and the next...
RUSTSEC-2026-0404 Double free in `DCtx::try_clone`
DCtx::tryclone experimental feature, deprecated is a plain copy of the C context. A context owning a dictionary from loaddictionary, refprefix or initusingdict or a dictionary table refddict with RefMultipleDDicts ended up with both copies freeing it. A context cloned mid-frame resumed on...
aedat (1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +455 more potentially affected by unknown CVE via zstd-safe (>=4.1.4+zstd.1.5.2, <=7.2.4)
zstd-safe CARGO version =4.1.4+zstd.1.5.2, =0.4.0, =0.1.32, =0.1.20, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 - archive-rs 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0404...
aedat (>=1.2.3, <=1.3.3), ai-dataloader (>=0.4.0, <=0.6.2) +528 more potentially affected by unknown CVE via zstd-safe (>=4.1.0+zstd.1.5.0, <=7.2.4)
zstd-safe CARGO version =4.1.0+zstd.1.5.0, =1.2.3, =0.4.0, =0.1.25, =0.1.12, =0.1.0, =0.1.0, =0.6.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.14.0, =0.16.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0395...
OESA-2026-4302 cyrus-sasl security update
The package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. Security Fixes: A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the...
OESA-2026-4303 cyrus-sasl security update
The package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. Security Fixes: A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the...
OESA-2026-4300 cyrus-sasl security update
The package contains the Cyrus implementation of SASL. SASL is the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. Security Fixes: A heap-based buffer overflow flaw was found in Cyrus SASL. The addtochallenge function in the...