CVE-2024-28101

CVE-2024-28101 concerns the Apollo Router (Rust) and affects versions 0.9.5 through 1.40.2. The vulnerability arises when handling compressed HTTP payloads: after decompression, the router evaluates limits.http_max_request_bytes, which can lead to significant memory consumption if highly compress...

Design/Logic Flaw

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

CVE-2024-27308

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

CVE-2024-27308 Mio's tokens for named pipes may be delivered after deregistration

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some...

CVE-2024-27308

CVE-2024-27308 affects the Mio Rust library (Windows named pipes). Vulnerable are Mio versions 0.7.2 through 0.8.10; fixed in 0.8.11. The issue is that, in certain cases, tokens for named pipes can refer to deregistered pipes, which can lead to use-after-free scenarios, especially if applications...

Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Route...

GHSA-CGQF-3CQ5-WVCJ Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

Impact The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Route...

*const c_void / ExternalPointer unsoundness leading to use-after-free

Summary Use of inherently unsafe const cvoid and ExternalPointer leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Details const cvoid and ExternalPointer defined via external! macros types are used to represent v8::External wrapping arbitrary void...

GHSA-3J27-563V-28WF *const c_void / ExternalPointer unsoundness leading to use-after-free

Summary Use of inherently unsafe const cvoid and ExternalPointer leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Details const cvoid and ExternalPointer defined via external! macros types are used to represent v8::External wrapping arbitrary void...

Mio Security Breach

Mio is the Metal I/O library for Rust. A security vulnerability exists in Mio versions v0.7.2 through prior to v0.8.11, which stems from the return of invalid tokens under certain circumstances, potentially leading to reuse after release...

bpxe-bpmn-schema (0.1.2), companion-service (0.1.0) +30 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.2, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.1.0, =0.2.1, =0.2.3, =0.0.1, =0.13.4 - kaspa-perf-monitor 0.13.4 - melodium 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0407...

openSUSE: Security Advisory for rust, rust1.72 (SUSE-SU-2023:3722-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-27284

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

Code injection

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

cassandra-rs Resource Management Error Vulnerability

cassandra-rs is an Apache Cassandra client library written in the Rust language. A security vulnerability exists in cassandra-rs versions prior to 3.0.0, which stems from a post-release reuse vulnerability...

CentOS 9 : rust-1.71.1-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the rust-1.71.1-1.el9 build changelog. - Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1,...

CVE-2024-27284 cassandra-rs non-idiomatic use of iterators leads to use after free

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

CVE-2024-27284

The CVE concerns the cassandra-rs Rust Cassandra (CQL) driver. A use-after-free exists when code uses an item from an iterator after advancing the iterator, potentially accessing freed memory. The issue is fixed in version 3.0.0; users with pre-3.0.0 versions should upgrade to 3.0.0 to mitigate. ...

CVE-2024-27284 cassandra-rs non-idiomatic use of iterators leads to use after free

cassandra-rs is a Cassandra CQL driver for Rust. Code that attempts to use an item e.g., a row returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour. The problem has been fixed in version 3.0.0...

asfa (>=0.1.0, <=0.5.2), bubbles (>=3.0.0, <=3.1.1) +27 more potentially affected by unknown CVE via whoami (>=0.5.3, <=1.2.3)

whoami CARGO version =0.5.3, =0.1.0, =3.0.0, =0.1.0, =0.1.0, =0.2.1, =0.0.0, =0.0.1, =0.1.0, =0.0.1, =0.9.2, =0.1.0, =0.4.0, =0.1.0, =0.8.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0020...