Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-2.hum1 aarch64, x8664 clippy-1.97.1-2.hum1 aarch64, x8664 rust-1.97.1-2.hum1 aarch64, x8664 rust-analyzer-1.97.1-2.hum1 aarch64, x8664 rust-debugger-common-1.97.1-2.hum1 noarch...

rust: Rust standard library didn't detect all path separators on Cygwin

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target x8664-pc-cygwin didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could...

CVE-2026-45784

A flaw was found in rust-openssl, a library providing OpenSSL bindings for the Rust programming language. When processing data with AES key-wrap-with-padding ciphers, the library incorrectly calculates the size of output buffers. This error can lead to memory corruption, where OpenSSL writes beyo...

Fedora 44 : llvm (2026-597e8f9de1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-597e8f9de1 advisory. Backport fixes from LLVM 23 - Fix an issue that could cause a buffer overflow when reading a corrupted bitcode file. - Fix a miscompilation known to affect...

CVE-2026-15957 Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

CVE-2026-15957

The CVE-2026-15957 issue affects smithy-rs codegen outputs for JSON, CBOR, and XML deserializers, where uncontrolled recursion on deeply nested data in a recursive model shape can cause a denial of service (process abort via stack exhaustion) when targeting generated SDKs or servers. Mitigation p...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-1.1.hum1 aarch64, x8664 clippy-1.97.1-1.1.hum1 aarch64, x8664 rust-1.97.1-1.1.hum1 aarch64, x8664 rust-analyzer-1.97.1-1.1.hum1 aarch64, x8664...

CVE-2026-60080

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

CVE-2026-60080 Apache Fory: Rust MetaString heap use-after-free

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

CVE-2026-60080

CVE-2026-60080 is a use-after-free in the Rust deserialization logic of Apache Fory. The vulnerability affects Apache Fory versions from 0.13.0 through 1.3.0. A crafted Fory payload can lead to undefined behavior, a process crash, or potential memory disclosure. The recommended remediation is upg...

EUVD-2026-46174

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

PT-2026-61860

Name of the Vulnerable Software and Affected Versions Apache Fory versions 0.13.0 through 1.3.0 Description A Use After Free issue exists in the Rust deserialization logic of Apache Fory. This occurs when the software handles a crafted Fory payload, which can lead to undefined behavior, process...

CVE-2026-46671

This CVE concerns the Rust-based onenote_parser. Prior to version 1.1.1, a crafted .onetoc2 file could cause Parser::parse_notebook to open files outside the notebook directory by joining entry names with the notebook base, without ensuring relative paths. The issue allows file-existence probing ...

CVE-2026-46428

CVE-2026-46428 affects the Rust mailer library lettre. Versions 0.10.1 through before 0.11.22 using the boring-tls backend have an inverted-boolean bug that silently disables TLS hostname verification under the default strict configuration. An on-path attacker presenting any chain-valid certifica...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

[SECURITY] Fedora 44 Update: rust-astral_async_zip-0.0.20-1.fc44

An asynchronous ZIP archive reading/writing crate...

[SECURITY] Fedora 44 Update: uv-0.11.28-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

[SECURITY] Fedora 43 Update: uv-0.11.28-1.fc43

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

[SECURITY] Fedora 43 Update: rust-astral_async_zip-0.0.20-1.fc43

An asynchronous ZIP archive reading/writing crate...

Linux Distros Unpatched Vulnerability : CVE-2026-45784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipherupdateinplace in...