226 matches found
[SECURITY] Fedora 44 Update: rust-reqsign-http-send-reqwest-4.0.0-1.fc44
Reqwest-based HTTP client implementation for reqsign...
[SECURITY] Fedora 44 Update: rust-native-tls-0.2.18-1.fc44
A wrapper over a platform's native TLS implementation...
[SECURITY] Fedora 44 Update: rust-astral_async_http_range_reader-0.10.0-1.fc44
A library for streaming reading of files over HTTP using range requests...
EUVD-2026-13596
tar-rs incorrectly ignores PAX size headers if header size is nonzero...
CVE-2026-33055 tar-rs incorrectly ignores PAX size headers if header size is nonzero
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...
CVE-2026-33055
CVE-2026-33055 affects the tar-rs crate (Rust tar library) version 0.4.44 and below, where conditional logic incorrectly skipped the PAX size header when the base header size was nonzero. This contrasts with other parsers that use the PAX size override, potentially causing archives to appear diff...
CVE-2026-32829
lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values...
UBUNTU-CVE-2026-32829
lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values...
tar-rs 安全漏洞
tar-rs is a Rust library for reading and writing tar archive files, developed by Alex Crichton. Versions of tar-rs prior to 0.4.44 contain security vulnerabilities. These vulnerabilities stem from defects in the unpackdir function, which handles symbolic links. Such defects could lead to arbitrar...
PT-2026-26570
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to correctly honor PAX size headers in the...
ffmpeg 安全漏洞
FFmpeg is a Rust library developed by a single developer. Versions 8.0 and 8.0.1 of FFMPEG contain security vulnerabilities, which stem from an oversight in the validation of quantization parameters. These vulnerabilities may lead to out-of-bounds reads, memory leaks, or system crashes...
CVE-2026-30960
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT Just-In-Time compilation engine, which is fully exposed via the CFFI Foreign Functi...
EUVD-2026-10704
rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and physics simulations functionalities. The vulnerability exists in the JIT Just-In-Time compilation engine, which is fully exposed via the CFFI Foreign Functi...
bws-web-server (>=0.1.0 <=0.1.1), pingora (>=0.1.0 <=0.6.0) +3 more potentially affected by CVE-2026-2836 via pingora-cache (>=0.1.1 <=0.6.0)
pingora-cache CARGO version =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.6.0 - revoke-gateway =0.3.0 - static-files-module =0.1.0 Source cves: CVE-2026-2836 Source advisory: OSV:RUSTSEC-2026-0035...
GHSA-3MMG-7C2Q-8938 `sha-rust` was removed from crates.io for malicious code
It appeared to be attempting to steal credentials from local files...
GHSA-6662-54XR-8423 `evm-units` was removed from crates.io for malicious code
It appeared to be attempting to steal cryptocurrency...
GHSA-J39J-6GW9-JW6H git2 has potential undefined behavior when dereferencing Buf struct
If the Buf struct is dereferenced immediately after calling new or default on the Buf struct, a null pointer is passed to the unsafe function slice::fromrawparts. According to the safety section documentation of the function, data must be non-null and aligned even for zero-length slices or slices...
WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware
Meta on Tuesday announced it's adding Strict Account Settings on WhatsApp to secure certain users against advanced cyber attacks because of who they are and what they do. The feature, similar to Lockdown Mode in Apple iOS and Advanced Protection in Android, aims to protect individuals, such as...