RUSTSEC-2026-0317 A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches...

A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches...

PT-2026-105971

Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches...

EUVD-2021-1826

Malware in sbrugna...

CVE-2021-26951

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

Out of bounds write in calamine

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

GHSA-PPQP-78XX-3R38 Out of bounds write in calamine

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

financ (>=0.1.0, <=0.3.0), fitparser (>=0.1.0, <=0.5.1) +16 more potentially affected by CVE-2021-26951 via calamine (>=0.11.8, <=0.16.2)

calamine CARGO version =0.11.8, =0.1.0, =0.1.0, =1.0.0, =0.2.0, =0.15.0, =0.11.0, =0.21.0, =0.16.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.1 and more Source cves: CVE-2021-26951 Source advisory: OSV:GHSA-PPQP-78XX-3R38...

CVE-2021-26951

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

CVE-2021-26951

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

Design/Logic Flaw

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

CVE-2021-26951

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

CVE-2021-26951

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

CVE-2021-26951

CVE-2021-26951 affects the Rust crate calamine prior to 0.17.0. The issue arises from using Vec::set_len without proper memory claiming, which can result in uninitialized memory being exposed to a user-provided Read operation, demonstrated by Sectors::get. This can lead to out-of-bounds/heap memo...

CVE-2021-26951

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

CVE-2021-26951: Out-of-bounds Write

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::setlen is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get...

RUSTSEC-2021-0034 office is unmaintained, use calamine instead

The office crate is unmaintained. Use calamine for reading excel files. Contact the office author for ownership of the package name...

office is unmaintained, use calamine instead

The office crate is unmaintained. Use calamine for reading excel files. Contact the office author for ownership of the package name...

financ (>=0.1.0, <=0.3.0), fitparser (>=0.1.0, <=0.5.1) +16 more potentially affected by CVE-2021-26951 via calamine (>=0.11.8, <=0.16.2)

calamine CARGO version =0.11.8, =0.1.0, =0.1.0, =1.0.0, =0.2.0, =0.15.0, =0.11.0, =0.21.0, =0.16.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.1 and more Source cves: CVE-2021-26951 Source advisory: OSV:RUSTSEC-2021-0015...

PT-2021-17192

Name of the Vulnerable Software and Affected Versions: calamine versions prior to 0.17.0 Description: The issue allows attackers to overwrite heap-memory locations because Vec::set len is used without proper memory claiming. This uninitialized memory is then used for a user-provided Read operatio...