3846 matches found
RUSTSEC-2026-0081 `logtrace` was removed from crates.io for malicious code
logtrace appeared to be downloading a RAT. The malicious crate had 2 versions published on 2026-04-01 that had a total of 30 downloads. There were no crates depending on this crate on crates.io. Thanks to Socket.dev for detecting and reporting this to the crates.io team!...
GHSA-J3W3-P6MR-3HRH DynFuture Drop Can Construct a Dangling Reference
DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata. This issue was reproduced against dyn-future 3.0.4 under Miri. The crate is unmaintained...
DynFuture Drop Can Construct a Dangling Reference
DynFuture is unsound because its Drop implementation transmutes a trait-object reference into unrelated reference types, which constructs an invalid reference from trait object metadata. This issue was reproduced against dyn-future 3.0.4 under Miri. The crate is unmaintained...
scalyc (>=0.0.2, <=0.0.5) potentially affected by unknown CVE via scaly (>=0.0.2, <=0.0.5)
scaly CARGO version =0.0.2, =0.0.2, =0.0.5 Source cves: unknown CVE Source advisory: OSV:GHSA-2C6H-4899-WJXR...
GHSA-2C6H-4899-WJXR scaly: Multiple soundness issues in Rust safe APIs
Affected versions contain multiple safe APIs that can trigger undefined behavior: - Array::index can perform an out-of-bounds read. - String::getlength can perform an out-of-bounds read. - String::appendcharacter can perform an invalid write. - String::tocstring can perform an out-of-bounds write...
Low: rust-below
Issue Overview: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used...
Amazon Linux 2023 : below (ALAS2023-2026-1523)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1523 advisory. time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack...
Amazon Linux 2023 : cargo-c (ALAS2023-2026-1527)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1527 advisory. A flaw in the gix-date library can generate invalid non-UTF8 strings, leading to undefined behavior when processed. The most likely impact from a successful attack is to data integrity, by the...
Security Bulletin: IBM Edge Data Collector uses time-0.3.37.crate which is vulnerable to CVE-2026-25727.
Summary IBM Edge Data Collector uses time-0.3.37.crate which is vulnerable to CVE-2026-25727. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-25727 DESCRIPTION: time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when...
[SECURITY] Fedora 42 Update: python-fastar-0.8.0-4.fc42
The fastar library wraps the Rust tar, flate2, and zstd crates, providing a high-performance way to work with compressed and uncompressed tar archives in Python...
[SECURITY] Fedora 43 Update: python-fastar-0.9.0-2.fc43
The fastar library wraps the Rust tar, flate2, and zstd crates, providing a high-performance way to work with compressed and uncompressed tar archives in Python...
[SECURITY] Fedora 44 Update: rust-astral-reqwest-retry-0.9.1-1.fc44
Retry middleware for reqwest...
libcrux-aead (>=0.0.4-pre.1, <=0.0.6) potentially affected by unknown CVE via libcrux-poly1305 (0.0.4)
libcrux-poly1305 CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-poly1305 and may be impacted: - libcrux-aead =0.0.4-pre.1, =0.0.6 Source cves: unknown CVE Source advisory: OSV:GHSA-PV9V-5J35-XWCR...
pqc-combo (0.1.0), pqc-fips (0.0.3) +1 more potentially affected by unknown CVE via libcrux-ml-dsa (0.0.4)
libcrux-ml-dsa CARGO version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on libcrux-ml-dsa and may be impacted: - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XRF2-5R3P-5WGJ...
GHSA-GCHP-Q4R4-X4FF tar-rs incorrectly ignores PAX size headers if header size is nonzero
Summary As part of CVE-2025-62518 the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. However, it was missed at the time that this project the original Rust tar crate had a conditional logic that skipped the PAX siz...
RUSTSEC-2026-0055 `tokio-process` is unmaintained
The tokio-process crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0059 `tokio-tcp` is unmaintained
The tokio-tcp crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
`tokio-sync` is unmaintained
The tokio-sync crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...