GHSA-QQC3-94QV-7FW3 Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Summary When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-outp...

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on...

GHSA-F45Q-W629-WR25 Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-73429 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-73429 Source advisory: OSV:GHSA-G9HV-X236-4QP3...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-73430 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-73430 Source advisory: OSV:GHSA-5XVQ-CP9X-6P6R...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-2.hum1 aarch64, x8664 clippy-1.97.1-2.hum1 aarch64, x8664 rust-1.97.1-2.hum1 aarch64, x8664 rust-analyzer-1.97.1-2.hum1 aarch64, x8664 rust-debugger-common-1.97.1-2.hum1 noarch...

rust: Rust standard library didn't detect all path separators on Cygwin

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target x8664-pc-cygwin didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could...

actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +265 more potentially affected by CVE-2026-25800 via quinn-proto (>=0.2.0, <=0.11.9)

quinn-proto CARGO version =0.2.0, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-25800 Source advisory: OSV:GHSA-4W2J-M93H-CJ5J...

CVE-2026-45784

A flaw was found in rust-openssl, a library providing OpenSSL bindings for the Rust programming language. When processing data with AES key-wrap-with-padding ciphers, the library incorrectly calculates the size of output buffers. This error can lead to memory corruption, where OpenSSL writes beyo...

SUSE-SU-2026:22921-1 Security update for rust-keylime

This update for rust-keylime fixes the following issues Update to version 0.2.9+49. Security issues fixed: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270174. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback...

bramble v0.9.3-android

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

EUVD-2026-48374

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous...

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has discovered a new Rust-based remote access trojan RAT we call "msaRAT" attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: "msaOpen," "msaClose," "msaError," and "msaMessage". msaRAT is implemented using the Tokio asynchronous...

[SECURITY] Fedora 44 Update: fractal-14.1-1.fc44

Fractal is a Matrix messaging app for GNOME written in Rust. Its interface is optimized for collaboration in large groups, such as free software projects...

[SECURITY] Fedora 43 Update: fractal-14.1-1.fc43

Fractal is a Matrix messaging app for GNOME written in Rust. Its interface is optimized for collaboration in large groups, such as free software projects...

Fedora 44 : llvm (2026-597e8f9de1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-597e8f9de1 advisory. Backport fixes from LLVM 23 - Fix an issue that could cause a buffer overflow when reading a corrupted bitcode file. - Fix a miscompilation known to affect...

abel (>=0.1.0, <=0.1.1), abel-core (>=0.1.0, <=0.1.1) +158 more potentially affected by unknown CVE via smallstr (>=0.1.0, <=0.3.1)

smallstr CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.8.1, =0.1.0, =0.1.20, =2.1.0, =0.4.0-beta.1, =0.5.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0215...

abscissa (>=0.4.0, <=0.6.0-pre.1), abscissa_core (>=0.4.0, <=0.6.0-pre.1) +121 more potentially affected by unknown CVE via gumdrop (>=0.1.0, <=0.8.1)

gumdrop CARGO version =0.1.0, =0.4.0, =0.4.0, =0.5.0, =0.1.1, =0.1.0, =0.2.0, =1.0.0, =1.0.6, =1.0.8, =1.0.9, =1.0.9, =1.0.12 - amdguid-glium 1.0.13 - amdguid-glow 1.0.13 - amdguid-wayland 1.0.13 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0214...

SUSE-SU-2026:22898-1 Security update for rust-keylime

This update for rust-keylime fixes the following issues: Update to version 0.2.9+49. Security issues fixed: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270174. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callbac...

SUSE-SU-2026:22895-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...