CVE-2025-69255: Improper Handling of Exceptional Conditions

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes getmetrics to unwrap failed deserialization of metrictype/opts, panicking the handler thread and enabling remote denial of service of the metrics...

abacuz (0.1.1), acmer (>=0.0.1, <=0.0.4) +371 more potentially affected by CVE-2026-21895 via rsa (>=0.1.2, <=0.8.2)

rsa CARGO version =0.1.2, =0.0.1, =0.12.0, =0.5.0, =0.2.0, =0.1.0, =1.0.1, =0.1.0, =0.3.11, =0.2.0, =0.1.0, =0.2.0, =0.11.0, =0.16.0 and more Source cves: CVE-2026-21895 Source advisory: OSV:GHSA-9C48-W39G-HM26...

Rust curve25519‑dalek Data Compromise

The vulnerability of the Rust library for arithmetic operations on the curve25519‑dalek elliptic curve is related to the removal of optimization during compilation or the elimination of critical code. Exploiting this vulnerability can allow an attacker to compromise the confidentiality of the...

acme-compilers (>=0.2.2, <=0.2.4), acvm (>=0.23.0, <=0.26.1) +297 more potentially affected by unknown CVE via rkyv (>=0.1.1, <=0.7.45)

rkyv CARGO version =0.1.1, =0.2.2, =0.23.0, =0.23.0, =0.0.1, =0.2.0, =0.39.0, =0.23.0, =0.26.1 - cairn-import-geonames 0.0.2-alpha - cairn-import-oa 0.0.2-alpha - cairn-import-osm 0.0.2-alpha - cairn-import-wof 0.0.2-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0001...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.5) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

PT-2026-8202

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's rust binder component related to handling FDA fd array objects. Specifically, the issue arises when processing empty FDA objects with a length of zero...

PT-2026-28333

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the rust binder component related to handling binder death notifications. Specifically, the set notification done function may be called without...

PT-2026-22490

Name of the Vulnerable Software and Affected Versions rust-rpm-sequoia affected versions not specified Description A flaw exists in rust-rpm-sequoia that allows an attacker to cause an application-level denial of service. This occurs when a specially crafted Red Hat Package Manager RPM file is...

PT-2026-4735

Name of the Vulnerable Software and Affected Versions gix-date affected versions not specified Description The gix date::parse::TimeBuf::as str function can produce strings with invalid, non-UTF8 characters. This breaks internal safety rules within the TimeBuf component, potentially causing...

PT-2025-55066

Уязвимость функции rust shrink free page модуля drivers/android/binder/page range.rs ядра операционной системы Linux связана с возникновением взаимной блокировки. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании...

blyss-rs (0.2.0), lunarbase-pmm-math (>=0.1.0, <=0.2.6) +8 more potentially affected by unknown CVE via ruint (>=1.8.0, <=1.16.0)

ruint CARGO version =1.8.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-9FJQ-45QV-PCM7...

aperture-shared (0.1.0), assemblylift-awslambda-host (>=0.2.0, <=0.3.0) +119 more potentially affected by unknown CVE via capnp (>=0.0.1, <=0.23.2)

capnp CARGO version =0.0.1, =0.2.0, =0.3.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.23.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0143...

Rust SSH DoS

The vulnerability of the Rust programming language’s Russh library for interacting with the SSH protocol is related to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

PT-2025-54613

The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::get root unchecked, which can cause undefined behavior UB by constructing arbitrary words or schemas. Reader::get rust pub fn get&self - Result::Reader // ... // UNSAFE: access words without validation...

blyss-rs (0.2.0), lunarbase-pmm-math (>=0.1.0, <=0.2.6) +8 more potentially affected by unknown CVE via ruint (>=1.8.0, <=1.16.0)

ruint CARGO version =1.8.0, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0137...

CISA and Partners Release Update to Malware Analysis Report BRICKSTORM Backdoor

Today, the Cybersecurity and Infrastructure Security Agency CISA, National Security Agency, and Canadian Centre for Cyber Security released an update to the Malware Analysis Report BRICKSTORM Backdoor with indicators of compromise IOCs and detection signatures for additional BRICKSTORM samples...

AZL-74805 CVE-2025-68114 affecting package rust for versions less than 1.90.0-4

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStreamconcat lets a malicious csoptmem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit...

AZL-74915 CVE-2025-67873 affecting package rust for versions less than 1.90.0-4

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make csdisasm/csdisasmiter memcpy more than 24 bytes into csinsn.bytes, causing a heap buffer overflow in the disassembly path. Commit...

SUSE CVE-2025-68260

In the Linux kernel, the following vulnerability has been resolved: rustbinder: fix race condition on deathlist Rust Binder contains the following unsafe operation: // SAFETY: A NodeDeath is never inserted into the death list // of any node other than its owner, so it is either in this // death...

Linux Distros Unpatched Vulnerability : CVE-2025-68260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustbinder: fix race condition on deathlist Rust Binder contains the following unsafe operation: // SAFETY: A NodeDeath is never inserted into the death list //...