CVE-2026-25727

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are...

EUVD-2026-5587

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are...

CVE-2026-25727 time affected by a stack exhaustion denial of service attack

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are...

abacuz (>=0.1.0, <=0.1.1), acceptxmr (>=0.1.0, <=0.13.0) +167 more potentially affected by CVE-2026-72813 via actix-files (>=0.1.0-alpha.6, <=0.6.6)

actix-files CARGO version =0.1.0-alpha.6, =0.1.0, =0.1.0, =1.0.0-alpha.6, =0.3.0, =0.9.0, =0.1.0, =0.1.0, =3.6.0, =0.6.0, =0.34.0 - bassment 0.1.0 - boltserver 0.11.11 and more Source cves: CVE-2026-72813 Source advisory: OSV:GHSA-GCQF-3G44-VC9P...

abacuz (>=0.1.0, <=0.1.1), acceptxmr (>=0.1.0, <=0.13.0) +167 more potentially affected by CVE-2026-72814 via actix-files (>=0.1.0-alpha.6, <=0.6.6)

actix-files CARGO version =0.1.0-alpha.6, =0.1.0, =0.1.0, =1.0.0-alpha.6, =0.3.0, =0.9.0, =0.1.0, =0.1.0, =3.6.0, =0.6.0, =0.34.0 - bassment 0.1.0 - boltserver 0.11.11 and more Source cves: CVE-2026-72814 Source advisory: OSV:GHSA-8V2V-WJWG-VX6R...

GHSA-R6V5-FH4H-64XC vulnerabilities

Vulnerabilities for packages: wasmcloud, topgrade, zed, rust-analyzer, zola, buck2, pixi, berg, oranda, zellij, cedar, linkerd2-proxy, cargo-audit, geckodriver, lychee, mountpoint-s3, sccache, wash, xh, uv, eza, deno, yara-x, wasm-pack, sqlx, shadowsocks-rust, qdrant, samply, starship, atuin,...

CVE-2026-25727 vulnerabilities

Vulnerabilities for packages: wasmcloud, topgrade, zed, rust-analyzer, zola, buck2, pixi, berg, oranda, zellij, cedar, linkerd2-proxy, cargo-audit, geckodriver, lychee, mountpoint-s3, sccache, wash, xh, uv, eza, deno, yara-x, wasm-pack, sqlx, shadowsocks-rust, qdrant, samply, starship, atuin,...

PT-2026-21483

It depended on the sha-rust crate, which appeared to be attempting to steal credentials from local files...

openmls (>=0.4.0-pre.1, <=0.4.0-pre.2), openmls_evercrypt (>=0.1.0-pre.1, <=0.1.0-pre.2) +2 more potentially affected by unknown CVE via hpke-rs (0.1.2)

hpke-rs CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on hpke-rs and may be impacted: - openmls =0.4.0-pre.1, =0.1.0-pre.1, =0.1.0-pre.1, =0.4.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0071...

Amazon Linux 2023 : aws-nitro-enclaves-cli, aws-nitro-enclaves-cli-devel, aws-nitro-enclaves-cli-integration-tests (ALAS2023-2026-1371)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1371 advisory. openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that...

Medium: aws-nitro-enclaves-cli

Issue Overview: openssl: rust-openssl Use-After-Free in Md::fetch and Cipher::fetch CVE-2025-3416 Affected Packages: aws-nitro-enclaves-cli Note: This advisory is applicable to Amazon Linux 2 - Nitro-enclaves Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ sectio...

AZL-76752 CVE-2026-25541 affecting package rust 1.72.0-14

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...

AZL-76721 CVE-2026-25541 affecting package rust for versions less than 1.90.0-6

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...

AZL-85059 CVE-2026-25541 affecting package rust-afterburn for versions less than 5.8.2-2

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...

DEBIAN-CVE-2026-25537

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim such as nbf or exp is provided with an incorrect JSON type Like a String instead of a Number, the library’s...

CVE-2026-25537

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim such as nbf or exp is provided with an incorrect JSON type Like a String instead of a Number, the library’s...

CVE-2026-25537

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim such as nbf or exp is provided with an incorrect JSON type Like a String instead of a Number, the library’s...

EUVD-2026-5334

jsonwebtoken is a JWT lib in rust. Prior to version 10.3.0, there is a Type Confusion vulnerability in jsonwebtoken, specifically, in its claim validation logic. When a standard claim such as nbf or exp is provided with an incorrect JSON type Like a String instead of a Number, the library’s...

a-gpt (>=0.1.0, <=0.4.0), abacuz (0.1.1) +1260 more potentially affected by unknown CVE via git2 (>=0.1.21, <=0.19.0)

git2 CARGO version =0.1.21, =0.1.0, =1.1.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.3.0, =0.3.1 - all-the-crate-names 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J39J-6GW9-JW6H...

GHSA-J39J-6GW9-JW6H git2 has potential undefined behavior when dereferencing Buf struct

If the Buf struct is dereferenced immediately after calling new or default on the Buf struct, a null pointer is passed to the unsafe function slice::fromrawparts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices...