226 matches found
EUVD-2025-29451
Malicious code in bioql PyPI...
EUVD-2022-6305
Malicious code in bioql PyPI...
CVE-2025-59058 httpsig-rs's HMAC verification is vulnerable to timing attack
httpsig-rs is a Rust implementation of IETF RFC 9421 http message signatures. Prior to version 0.0.19, the HMAC signature comparison is not timing-safe. This makes anyone who uses HS256 signature verification vulnerable to a timing attack that allows the attacker to forge a signature. Version...
CLSA-2025-1755618280 Update of rust
Rebuild...
UBUNTU-CVE-2023-53159
The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::sethost...
UBUNTU-CVE-2023-53161
The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic...
UBUNTU-CVE-2023-53156
The transpose crate before 0.2.3 for Rust allows an integer overflow via inputwidth and inputheight arguments...
UBUNTU-CVE-2024-58261
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type...
UBUNTU-CVE-2025-53605
The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::codedinputstream::CodedInputStream::skipgroup parsing of unknown fields in untrusted input...
Mozilla neqo 安全漏洞
Mozilla neqo is a Rust protocol library from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla neqo versions 0.4.24 through 0.13.2, which stems from improper input validation and may cause a crash...
GHSA-JQ8X-V7JW-V675 Duplicate Advisory: users may append `root` to group listings
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m65q-v92h-cm7q. This link is maintained to preserve external references. Original Description A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group...
CVE-2025-48756
The CVE-2025-48756 entry concerns the scsir crate (Rust) version 0.2.0, where the function group_number can overflow when a hardware device expects a small number of bits (for example 5) to represent the group number. This is the stated root cause and aligns with the NVD description. The availabl...
CVE-2024-40648
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The UserIdentity::isverified method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result retur...
CVE-2024-44073
The Miniscript aka rust-miniscript library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth...
[SECURITY] Fedora 41 Update: python-watchfiles-1.0.3-4.fc41
Simple, modern and high performance file watching and code reload in python. Underlying file system notifications are handled by the Notify rust library...
[SECURITY] Fedora 42 Update: python-watchfiles-1.0.4-5.fc42
Simple, modern and high performance file watching and code reload in python. Underlying file system notifications are handled by the Notify rust library...
CVE-2021-41149
Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...
CVE-2019-15548
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled...