CVE-2026-33040: Integer Overflow or Wraparound

libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff state. A specially crafted PRUNE contr...

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Details A Path Traversal and Access Control Bypass vulnerability was discovered in the salvo-proxy component of the Salvo Rust framework v0.89.2. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and access unintended backend paths e.g., protected...

aati (>=0.10.2, <=0.11.3), acpica-bindings (>=0.1.0, <=0.1.2) +917 more potentially affected by CVE-2026-33056 via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.2.0, =0.2.5-rc.5, =0.1.0-alpha.1, =0.0.1, =0.1.2, =0.2.0, =0.1.2, =0.1.2-dev1, =0.1.0, =0.1.2 and more Source cves: CVE-2026-33056 Source advisory: OSV:RUSTSEC-2026-0067...

aati (>=0.10.2, <=0.11.3), acpica-bindings (>=0.1.0, <=0.1.2) +917 more potentially affected by CVE-2026-33055 via tar (>=0.2.14, <=0.4.40)

tar CARGO version =0.2.14, =0.10.2, =0.1.0, =0.1.2, =0.2.0, =0.2.5-rc.5, =0.1.0-alpha.1, =0.0.1, =0.1.2, =0.2.0, =0.1.2, =0.1.2-dev1, =0.1.0, =0.1.2 and more Source cves: CVE-2026-33055 Source advisory: OSV:RUSTSEC-2026-0068...

RUSTSEC-2026-0068 tar-rs incorrectly ignores PAX size headers if header size is nonzero

Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518astral-cve, the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the...

`unpack_in` can chmod arbitrary directories by following symlinks

In versions 0.4.44 and below of tar-rs, when unpacking a tar archive, the tar crate's unpackdir function uses fs::metadatafs-metadata to check whether a path that already exists is a directory. Because fs::metadata follows symbolic links, a crafted tarball containing a symlink entry followed by a...

PT-2026-26570

Name of the Vulnerable Software and Affected Versions tar-rs versions 0.4.44 and below Description tar-rs, a Rust library for reading and writing tar archives, contains a flaw in its handling of PAX size headers. Specifically, versions 0.4.44 and below have conditional logic that skips the PAX si...

openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:20364-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20364-1 advisory. - Update to version 0.2.8+116: - CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. bsc1257908...

PT-2026-26181

Name of the Vulnerable Software and Affected Versions libp2p-rust versions prior to 0.49.3 Description The libp2p-rust Gossipsub implementation is susceptible to a remote, unauthenticated denial-of-service condition. The implementation accepts attacker-controlled PRUNE backoff values and performs...

Security update for clamav

This update for clamav fixes the following issues: Update to clamav 1.5.2: Security issue: CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to denial of service conditions via a crafted HTML file bsc1259207. Non security issue: Support...

SUSE-SU-2026:0906-1 Security update for clamav

This update for clamav fixes the following issues: Update to clamav 1.5.2: Security issue: - CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to denial of service conditions via a crafted HTML file bsc1259207. Non security issue: - Support...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +105 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =0.2.5, =0.2.7 - dekoder 0.1.0 - diamond-types 1.0.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:RUSTSEC-2026-0041...

Linux Distros Unpatched Vulnerability : CVE-2026-32829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lz4flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +105 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =0.2.5, =0.2.7 - dekoder 0.1.0 - diamond-types 1.0.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:GHSA-VVP9-7P8X-RFVV...

OPENSUSE-SU-2026:20364-1 Security update for rust-keylime

This update for rust-keylime fixes the following issues: - Update to version 0.2.8+116: - CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. bsc1257908...

SUSE-SU-2026:20744-1 Security update for rust-keylime

This update for rust-keylime fixes the following issues: - Update to version 0.2.8+116: - CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. bsc1257908...

CVE-2026-32314

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULTCREDIT e.g. 262145. On the first packet of a new...

DEBIAN-CVE-2026-32314

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULTCREDIT e.g. 262145. On the first packet of a new...

UBUNTU-CVE-2026-32314

Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULTCREDIT e.g. 262145. On the first packet of a new...

FFmpeg security vulnerabilities

FFmpeg is a Rust library developed by a single developer. Versions 8.0 and 8.0.1 of FFMPEG contain security vulnerabilities, which stem from an oversight in the validation of quantization parameters. These vulnerabilities may lead to out-of-bounds reads, memory leaks, or system crashes...