RUSTSEC-2026-0333 Resource budgets not enforced on the typed deserialization path

ParserConfig::maxevents, maxnodes, maxtotalscalarbytes, maxmergekeys, aliasanchorratio and the alias jump factor were enforced only by the two Value loaders. A typed target with a default-shaped configuration is served by the streaming deserializer, which never read those fields, so tightening an...

Malicious code in ts-bn-lint (npm)

Source: amazon-inspector e591f0b407bc22e3abe20da9207df2d2922f75d98ab97aaa62557ca88b8fc349 [email protected] is a credential harvester disguised as a TypeScript/lint utility. index.js defines decodeStr which base64-decodes all operationally sensitive strings, including the C2 endpoint...

Malicious code in ts-bn-lint-helper (npm)

Source: amazon-inspector 8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267 Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported fromstr recursively walks process.cwd and uploads every file matching id.json, config.toml,...

CVE-2026-29795

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::fromstr does not validate that the input length is within the declared maximum MAX. Calling StringM::::fromstrs where s is longer than N bytes succeeds and returns a...

CVE-2026-29795 stellar-xdr: `StringM::from_str` bypasses max length validation

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::fromstr does not validate that the input length is within the declared maximum MAX. Calling StringM::::fromstrs where s is longer than N bytes succeeds and returns a...

CVE-2026-29795 stellar-xdr: `StringM::from_str` bypasses max length validation

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::fromstr does not validate that the input length is within the declared maximum MAX. Calling StringM::::fromstrs where s is longer than N bytes succeeds and returns a...

CVE-2026-29795: Allocation of Resources Without Limits or Throttling

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::fromstr does not validate that the input length is within the declared maximum MAX. Calling StringM:: ::fromstrs where s is longer than N bytes succeeds and returns ...

WS-2022-0043

Stack overflow in rustcserialize when parsing deeply nested JSON. All versions of rustc-serialize through 0.3.24 are affected. When parsing JSON using json::Json::fromstr, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the...

ron:from_str: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6472212835008512 Project: ron Fuzzing Engine: libFuzzer Fuzz Target: fromstr Job Type: libfuzzerasanron Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash Revision:...