CVE-2025-62518

astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives...

CVE-2024-23644

Trillium is a composable toolkit for building internet applications with async rust. In trillium-http prior to 0.3.12 and trillium-client prior to 0.5.4, insufficient validation of outbound header values may lead to request splitting or response splitting attacks in scenarios where attackers have...

CVE-2024-23644

CVE-2024-23644 affects Trillium, specifically the crates trillium-http (versions prior to 0.3.12) and trillium-client (prior to 0.5.4). The issue is improper validation of outbound header values and names, where header values/names can be constructed infallibly and may contain illegal bytes. If a...