CVE-2026-95623

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...

CVE-2026-95623 Tauri framework v2 SSRF Protection Bypass via HTTP Redirects

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...

CVE-2026-95623: Server-Side Request Forgery (SSRF)

The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...

RMCP: Custom HTTP headers leak to cross-origin redirect targets

Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...

CVE-2026-64684: Exposure of Sensitive Information to an Unauthorized Actor

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...

surf is unmaintained

The surf crate is unmaintained, and all versions are affected. For alternatives, consider using reqwest or ureq. See this issue for more context...

RUSTSEC-2026-0169 surf is unmaintained

The surf crate is unmaintained, and all versions are affected. For alternatives, consider using reqwest or ureq. See this issue for more context...

PT-2026-49130

The surf crate is unmaintained, and all versions are affected. For alternatives, consider using reqwest or ureq. See this issue for more context...

CVE-2026-45310: Server-Side Request Forgery (SSRF)

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetchurl tool validates the initial URL's resolved IP address against a restricted-IP blocklist isrestrictedip to prevent SSRF attacks against internal services cloud metadata endpoints, localhost, private networks...

[SECURITY] Fedora 44 Update: rust-reqsign-http-send-reqwest-4.0.0-1.fc44

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 44 Update: rust-astral-reqwest-middleware-0.5.1-1.fc44

Wrapper around reqwest to allow for client middleware chains...

[SECURITY] Fedora 44 Update: rust-astral-reqwest-retry-0.9.1-1.fc44

Retry middleware for reqwest...

[SECURITY] Fedora 42 Update: rust-gst-plugin-reqwest-0.13.3-4.fc42

GStreamer reqwest HTTP Source Plugin...

[SECURITY] Fedora 41 Update: rust-reqsign-http-send-reqwest-2.0.1-1.fc41

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 42 Update: rust-reqsign-http-send-reqwest-2.0.1-1.fc42

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 43 Update: rust-reqsign-http-send-reqwest-2.0.1-1.fc43

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 43 Update: rust-reqsign-http-send-reqwest-2.0.0-1.fc43

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 42 Update: rust-reqsign-http-send-reqwest-2.0.0-1.fc42

Reqwest-based HTTP client implementation for reqsign...

[SECURITY] Fedora 41 Update: rust-reqsign-http-send-reqwest-2.0.0-1.fc41

Reqwest-based HTTP client implementation for reqsign...

RUSTSEC-2025-0036 surf is unmaintained

The developer has indicated that the crate is unmaintained. The last release is over three years old from 2021, the crate depends on the deprecated async-std crate and on a very old version of rustls for TLS support. Possible alternatives - reqwest - ureq...