SUSE-SU-2026:22898-1 Security update for rust-keylime

This update for rust-keylime fixes the following issues: Update to version 0.2.9+49. Security issues fixed: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270174. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callbac...

SUSE-SU-2026:22895-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...

SUSE-SU-2026:22841-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate bsc1270542. - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl cra...

OPENSUSE-SU-2026:21406-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate bsc1270542. - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl cra...

CVE-2026-15957 Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

CVE-2026-15957

The CVE-2026-15957 issue affects smithy-rs codegen outputs for JSON, CBOR, and XML deserializers, where uncontrolled recursion on deeply nested data in a recursive model shape can cause a denial of service (process abort via stack exhaustion) when targeting generated SDKs or servers. Mitigation p...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rust: cargo-1.97.1-1.1.hum1 aarch64, x8664 clippy-1.97.1-1.1.hum1 aarch64, x8664 rust-1.97.1-1.1.hum1 aarch64, x8664 rust-analyzer-1.97.1-1.1.hum1 aarch64, x8664...

CVE-2026-60080

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

CVE-2026-60080 Apache Fory: Rust MetaString heap use-after-free

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

CVE-2026-60080

CVE-2026-60080 is a use-after-free in the Rust deserialization logic of Apache Fory. The vulnerability affects Apache Fory versions from 0.13.0 through 1.3.0. A crafted Fory payload can lead to undefined behavior, a process crash, or potential memory disclosure. The recommended remediation is upg...

EUVD-2026-46174

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which...

Amazon Linux 2 : rust, --advisory ALAS2-2026-3808 (ALAS-2026-3808)

The version of rust installed on the remote host is prior to 1.97.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3808 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing...

PT-2026-61860

Name of the Vulnerable Software and Affected Versions Apache Fory versions 0.13.0 through 1.3.0 Description A Use After Free issue exists in the Rust deserialization logic of Apache Fory. This occurs when the software handles a crafted Fory payload, which can lead to undefined behavior, process...

CVE-2026-46671

This CVE concerns the Rust-based onenote_parser. Prior to version 1.1.1, a crafted .onetoc2 file could cause Parser::parse_notebook to open files outside the notebook directory by joining entry names with the notebook base, without ensuring relative paths. The issue allows file-existence probing ...

CVE-2026-46428

CVE-2026-46428 affects the Rust mailer library lettre. Versions 0.10.1 through before 0.11.22 using the boring-tls backend have an inverted-boolean bug that silently disables TLS hostname verification under the default strict configuration. An on-path attacker presenting any chain-valid certifica...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

SUSE-SU-2026:22801-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...

Important: rust

Issue Overview: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in...

[SECURITY] Fedora 44 Update: rust-astral_async_zip-0.0.20-1.fc44

An asynchronous ZIP archive reading/writing crate...

[SECURITY] Fedora 44 Update: uv-0.11.28-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...