12674 matches found
Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1565)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1565 advisory. tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As par...
[SECURITY] Fedora 43 Update: fido-device-onboard-0.5.5-8.fc43
A rust implementation of the FIDO Device Onboard Specification...
CVE-2026-40093 nimiq-blockchain is missing a wall-clock upper bound on block timestamps
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper...
auth_service_dhz (0.1.9), bin-proto (>=0.9.1, <=0.12.6) +8 more potentially affected by unknown CVE via rand (>=0.9.0, <=0.9.2)
rand CARGO version =0.9.0, =0.9.1, =0.1.0, =0.14.0, =0.1.0, =1.3.0, =2.1.0, =0.8.6, =0.1.2, =0.3.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0097...
Data leakage between pooling allocator instances
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p For more information see the GitHub-hosted security advisory...
rust: Rust standard library didn't detect all path separators on Cygwin
Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target x8664-pc-cygwin didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could...
CVE-2026-40093: Improper Validation of Specified Quantity in Input
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper...
N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust
The North Korea-linked persistent campaign known as Contagious Interview has spread its tentacles by publishing malicious packages targeting the Go, Rust, and PHP ecosystems. "The threat actor's packages were designed to impersonate legitimate developer tooling ..., while quietly functioning as...
CVE-2026-35457
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed i...
CVE-2026-35457
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed i...
CVE-2026-35457 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed i...
CVE-2026-35457
CVE-2026-35457 affects libp2p-rust prior to 0.17.1, where the rendezvous server stores pagination cookies without bounds. The DISCOVER handling creates new cookies and inserts them into Registrations::cookies with no upper bound or eviction, enabling an unauthenticated peer to trigger repeated re...
CVE-2026-35457 libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed i...
zantetsu-ffi is unmaintained
The zantetsu-ffi crate is no longer maintained. The Node.js, Python, and C FFI bindings it provided were removed as part of the zantetsu 0.2 release, which refocused the project on its core Rust library. A tombstone version 0.2.0 has been published and 0.1.4 has been yanked. There is no replaceme...
RUSTSEC-2026-0082 zantetsu-ffi is unmaintained
The zantetsu-ffi crate is no longer maintained. The Node.js, Python, and C FFI bindings it provided were removed as part of the zantetsu 0.2 release, which refocused the project on its core Rust library. A tombstone version 0.2.0 has been published and 0.1.4 has been yanked. There is no replaceme...
rust-libp2p 安全漏洞
rust-libp2p is a Rust implementation of the libp2p open-source network stack. Versions of rust-libp2p prior to 0.17.1 contained a security vulnerability. This vulnerability stemmed from the lack of boundary settings when the meeting server stored paginated cookies, allowing unauthenticated peer...
rust-libp2p 安全漏洞
rust-libp2p is a Rust implementation of the libp2p open-source network stack. Prior to version 0.17.1, rust-libp2p had a security vulnerability. This vulnerability stemmed from the unlimited number of namespaces that rendezvous servers could register for individual peers, which could lead to memo...
CVE-2026-35405: Allocation of Resources Without Limits or Throttling
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts...
CVE-2026-35457: Allocation of Resources Without Limits or Throttling
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed i...
