rustsec

RustSec クレート 🦀🛡️📦 RustSec アドバイザリデータベースは、crates.io で公開されている Rust クレートに対して報告されたセキュリティアドバイザリをまとめたリポジトリです。 アドバイザリデータベース自体は、以下で参照できます: https://github.com/RustSec/advisory-db このリポジトリについて このリポジトリには、RustSec プロジェクトが保守しているすべてのクレートを含む Cargo ワークスペースが格納されています: 名前| 説明| クレート| ドキュメント| ビルド ---|---|---|---|---...

so-crates

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus pcapファイル、ログファイル、バイナリファイルを分析するためのスタンドアロンWebアプリケーション。機能にはSuricataによるネットワーク分析、YARAによるバイナリスキャン、ログに対するSigmaルール検出、アラート・メタデータ・トランスクリプト・hexdumpを閲覧するためのシングルページUIが含まれます。 📖 完全なドキュメント: https://so-crates.org/ ドキュメント インタラクティブデモ...

HiddenSteps

핵심 크레이트 — 구현 현황 이는 docs/design/02-system-architecture.md의 대상 모듈 맵에 대한 솔직한 현재 상태 보충 자료입니다. 실제로 구축된 것, 목mock이 아닌 실제 백엔드에 대해 검증된 것, 그리고 여전히 실제로 누락된 것을 설명합니다 — 계획된 것이 아니라요 계획은 docs/roadmap/01-implementation-roadmap.md에 있습니다. 저장소 루트에서 cargo build --workspace && cargo test --workspace && cargo clippy...

CVE-2026-97365

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly...

PT-2026-98293

Name of the Vulnerable Software and Affected Versions chonkie-inc littrs versions 0.6.1 through 0.6.2 Description A remote path traversal issue exists in the Sandbox::mount function within the crates/littrs/src/lib.rs file. This occurs when the relative argument is manipulated, allowing an attack...

CVE-2026-92362: Uncontrolled Resource Consumption

A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request t...

CVE-2026-63128: Uncontrolled Resource Consumption

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamablehttpserver/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or a...

Fedora 46 : rust-hickory-net / rust-hickory-proto / rust-hickory-resolver (2026-08a5c52d65)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-08a5c52d65 advisory. Update hickory-dns crates to version 0.26.2. This includes fixes for a large number of security relevant bugs. Release notes:...

[SECURITY] Fedora 43 Update: rust-crates-io-0.41.0-1.fc43

Helpers for interacting with crates.io...

[SECURITY] Fedora 44 Update: rust-crates-io-0.41.0-1.fc44

Helpers for interacting with crates.io...

CVE-2026-81036: URL Redirection to Untrusted Site

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

Fedora 44 : rust-anstyle-hyperlink / rust-anstyle-progress / rust-cargo / etc (2026-77528477c2)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-77528477c2 advisory. - Update cargo-c to version 0.10.24 plus dependency updates. - Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates...

`internment` 0.8.7 was removed from crates.io due to a malicious dependency

A new version of the internment crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 90 minutes later. The compromised version was used as part of...

`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency

A new version of the append-only-vec crate was published with a direct dependency on proc-macro1, which would execute a malicious build script. The compromised version of this crate was published on 2026-08-20, and was removed approximately 107 minutes later. The compromised crate version was use...

`aronenao` was removed from crates.io due to malicious code

We identified that aronenao contained malicious code executed through a build script. This crate had 11 versions, with the most recent one being published at 2026-08-18. The crate was removed from crates.io and the user account was locked. This crate was used as part of a malware campaign targete...

Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

Fedora 45 : rust-anstyle-hyperlink / rust-anstyle-progress / rust-cargo / etc (2026-67365d8467)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-67365d8467 advisory. - Update cargo-c to version 0.10.24 plus dependency updates. - Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates...

CVE-2026-54740: Missing Authorization

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

PT-2026-76454

These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-73285

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...