328 matches found
Amazon Linux 2 : rust, --advisory ALAS2-2026-3808 (ALAS-2026-3808)
The version of rust installed on the remote host is prior to 1.97.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3808 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing...
Astra Linux – Vulnerability in RustC
In the standard library of Rust before version 1.29.0, there is weak synchronization in the Arc::getmut method. This synchronization issue can lead to memory safety issues due to race conditions...
CVE-2026-44983
Summary of CVE-2026-44983 (smallbitvec): An integer overflow in the internal capacity calculation (cap + bits_per_storage() - 1) can produce an undersized heap allocation, enabling a heap buffer overflow through safe APIs in versions 1.0.1–2.6.0 of the Rust crate smallbitvec. This can cause memor...
Astra Linux – Vulnerability in RustC
In the standard library of Rust before version 1.52.0, a double-free error can occur in the Vec::fromiter function if the process of freeing the element causes a panic...
The vulnerability of the software tools for working with secure metadata, namely the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to integer overflow. This vulnerability allows attackers to trigger a service failure.
The vulnerability of the software tools for working with secure metadata, such as the Content Authenticity JS SDK and the Content Authenticity Rust SDK, is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to cause service failures...
GHSA-GHM9-CR32-G9QJ rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
EVPDigestFinal always writes EVPMDCTXsizectx to the out buffer. If out is smaller than that, MdCtxRef::digestfinal writes past its end, usually corrupting the stack. This is reachable from safe Rust...
The vulnerability of the libp2p-rust library server allows a hacker to trigger a service failure.
The vulnerability of the libp2p-rust library server is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending DISCOVER requests...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rust1.93 (SUSE-SU-2026:1415-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1415-1 advisory. Security issue: - CVE-2026-31812: denial of service via crafted QUIC initial packet bsc1259623. Non...
USN-8168-1: Rust vulnerability
It was discovered that tar-rs embedded in rustc incorrectly handled symlinks when unpacking a tar archive. If a user or automated system were tricked into processing a specially crafted tar archive, a remote attacker could use this issue to modify permissions of arbitrary directories outside the...
Fedora 44 : rust (2026-30b1c7e18a)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-30b1c7e18a advisory. Update to 1.94.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
CVE-2026-33693
Lemmy’s Activitypub-Federation vulnerable component: Rust-based v4_is_invalid() in activitypub_federation-rust fails to check IPv4Addr::UNSPECIFIED (0.0.0.0). An unauthenticated attacker controlling a remote domain could direct 0.0.0.0 and bypass SSRF protections, reaching localhost services on t...
Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
The v4isinvalid function in activitypub-federation-rust src/utils.rs does not check for Ipv4Addr::UNSPECIFIED 0.0.0.0. An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 GHSA-7723-35v7-qcxw, and reac...
`unpack_in` can chmod arbitrary directories by following symlinks
In versions 0.4.44 and below of tar-rs, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadatafs-metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball containing a symlink entry followed by a...
Amazon Linux 2 : rust, --advisory ALAS2-2026-3188 (ALAS-2026-3188)
The version of rust installed on the remote host is prior to 1.92.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3188 advisory. No CVE was issued for this update. Tenable has extracted the preceding description block directly from the tested product security...
AZL-79475 CVE-2026-3381 affecting package rust 1.90.0-4
Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for...
AZL-78179 CVE-2026-27171 affecting package rust 1.72.0-14
zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...
Exploit for CVE-2025-62518
Tarmageddon CVE-2025-62518https://nvd.nist.gov/vuln/detail/...
CVE-2021-28307
An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon...