RUSTSEC-2025-0156 `tree-sitter-pkl` was removed from crates.io for malicious code

tree-sitter-pkl was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

CVE-2023-33289

The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service ReDos via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."...

PT-2025-28031 · Protobuf +1 · Protobuf +1

Name of the Vulnerable Software and Affected Versions: protobuf crate for Rust versions prior to 3.7.2 Description: The issue allows uncontrolled recursion in the protobuf::coded input stream::CodedInputStream::skip group function when parsing unknown fields in untrusted input. This can occur due...

AskAI (=0.1.0), ISP-SDK (>=0.1.0 <=0.2.3) +5216 more potentially affected by CVE-2025-4432 via ring (>=0.13.5 <=0.16.20)

ring CARGO version =0.13.5, =0.1.0, =0.1.0, =0.2.0, =0.10.2, =0.1.0, =0.2.0-beta.4, =0.21.0-alpha.1, =0.1.1, =0.11.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0-alpha.0 and more Source cves: CVE-2025-4432 Source advisory: OSV:RUSTSEC-2025-0009...

Linux Distros Unpatched Vulnerability : CVE-2025-24898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions ssl::selectnextproto can return a slice pointing into the serv...

AskAI (=0.1.0), ISP-SDK (>=0.1.0 <=0.2.3) +5216 more potentially affected by unknown CVE via ring (>=0.13.5 <=0.16.20)

ring CARGO version =0.13.5, =0.1.0, =0.1.0, =0.2.0, =0.10.2, =0.1.0, =0.2.0-beta.4, =0.21.0-alpha.1, =0.1.1, =0.11.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0-alpha.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0010...

Linux Distros Unpatched Vulnerability : CVE-2022-36113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the /.cargo folder on disk, makin...

Linux Distros Unpatched Vulnerability : CVE-2020-36317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the standard library in Rust before 1.49.0, String::retain function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provid...

Linux Distros Unpatched Vulnerability : CVE-2020-36323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed or the program to...

Linux Distros Unpatched Vulnerability : CVE-2023-38497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not...

Linux Distros Unpatched Vulnerability : CVE-2022-46176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and...

Linux Distros Unpatched Vulnerability : CVE-2021-45710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot...

Linux Distros Unpatched Vulnerability : CVE-2022-21658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG w...

Linux Distros Unpatched Vulnerability : CVE-2020-36471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function for yielding values has Send bounds. CVE-2020-36471 Not...

Linux Distros Unpatched Vulnerability : CVE-2020-25793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From...

Linux Distros Unpatched Vulnerability : CVE-2023-40030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when...

Linux Distros Unpatched Vulnerability : CVE-2020-25016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to for example dereferencing of arbitrary pointers or disclosure of...

Linux Distros Unpatched Vulnerability : CVE-2020-25575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce compatibility hazards in some applications, and has a type confusion flaw...

ISP-SDK (=0.2.3), actix-elastic (>=1.0.0 <=1.0.7) +236 more potentially affected by unknown CVE via backoff (>=0.1.6 <=0.4.0)

backoff CARGO version =0.1.6, =1.0.0, =0.4.0, =0.2.0, =0.1.0, =0.2.0, =0.5.1, =0.2.0-beta.0, =0.6.0, =0.2.0, =0.5.0 - adventure-rusoto-ecs =0.4.0 - adventure-rusoto-sns =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0012...

Linux Distros Unpatched Vulnerability : CVE-2019-25010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when privategettypeid is overridden. CVE-2019-25010 Note that...