288 matches found
PT-2026-99977
rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...
PT-2026-99981
rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...
TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. For example, a plaintext EncryptedExtensions message packed into the same record as the ServerHello was accepted. RFC 8446 section 5.1 requires that handshak...
rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List
A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...
rustls v/0.23.44
Rustls is a modern TLS library written in Rust. Status Rustls is used in production at many organizations and projects. We aim to maintain reasonable API surface stability but the API may evolve as we make changes to accommodate new features or performance improvements. We have a roadmap for our...
rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List
A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...
rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List
A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...
GO-2025-3678 vulnerabilities
Vulnerabilities for packages: lychee, linkerd2-proxy, rustls-ffi, zola, kdash, rye, tealdeer, wasm-pack, deno, sccache, qdrant, samply, buck2, wadm, parseable, oranda, rustup, shadowsocks-rust, wasmcloud, pixi, nushell, zed, sdp-k8s-injector, xh, wash, wasmtime, linkerd-extension-init, ntpd-rs, u...
Уязвимость TLS-библиотеки Rustls, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю вызвать отказ в обслуживании
Уязвимость TLS-библиотеки Rustls связана с выполнением цикла с недоступным условием выхода. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...
rustls-webpki: rustls-webpki: Denial of Service via crafted Certificate Revocation List
A flaw was found in rustls-webpki. A remote attacker, by influencing an application to parse a specially crafted Certificate Revocation List CRL that contains an empty onlySomeReasons value in its issuingDistributionPoint extension, could trigger a panic. This vulnerability leads to a denial of...
SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3022-1 advisory. Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when ...
Security update for sccache
This update for sccache fixes the following issues: Update to version 0.15.017. CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes HTTP2 RSTSTREAM frames bsc1210346. CVE-2024-32650: rust-rustls: infinite loop in...
SUSE-SU-2026:3022-1 Security update for sccache
This update for sccache fixes the following issues: Update to version 0.15.017. - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes HTTP2 RSTSTREAM frames bsc1210346. - CVE-2024-32650: rust-rustls: infinite loop in...
curl: mbedTLS / wolfSSL / rustls backends silently skip hostname verification when CURLOPT_SSL_VERIFYPEER=0
Summary When an application sets CURLOPTSSLVERIFYPEER=0 while keeping CURLOPTSSLVERIFYHOST=2 the default, the mbedTLS, wolfSSL, and rustls TLS backends silently skip the hostname-vs-certificate check. The OpenSSL, GnuTLS, and Schannel backends correctly preserve hostname checking under the same...
CVE-2026-45784 vulnerabilities
Vulnerabilities for packages: ztunnel-fips, typst, sccache, rpm-sequoia, valkey-ldap, komodo, guestproxyagent, sentry-cli, bootc, sqlx, sdp-k8s-injector, vector, deno, rustup, rustls-openssl-client...
GHSA-PHQJ-4MHP-Q6MQ vulnerabilities
Vulnerabilities for packages: ztunnel-fips, typst, sccache, rpm-sequoia, valkey-ldap, komodo, guestproxyagent, sentry-cli, bootc, sqlx, sdp-k8s-injector, vector, deno, rustup, rustls-openssl-client...
curl: rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active
Hi all, When the rustls backend is configured to use the OS native CA store --ca-native / CURLSSLOPTNATIVECA, any CRL file supplied via --crlfile / CURLOPTCRLFILE is silently ignored. The option is accepted — CURLEOK from curleasysetopt, exit 0 from the command line — and revoked certificates pas...
curl: TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0
The now-well-known CURLOPTSSLVERIFYHOST-bypass-when-CURLOPTSSLVERIFYPEER=0 defect exists in three of curl's TLS backends: rustls EXPERIMENTAL, mbedTLS, and wolfSSL DNS hostnames only. The documented contract at docs/libcurl/opts/CURLOPTSSLVERIFYPEER.md:57-59: The check that the host name in the...
curl: CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support them
From the Mythos report 2026-05-06 F1. CURLOPTPROXYCRLFILE / CURLOPTPROXYISSUERCERT / CURLOPTPROXYISSUERCERTBLOB silently ignored on backends that don't support them — severity Low https://github.com/curl/curl/blob/455bebc2c7/lib/setopt.cL1786-L1797...
CVE-2026-41898 vulnerabilities
Vulnerabilities for packages: ztunnel-fips, typst, sccache, rpm-sequoia, valkey-ldap, komodo, guestproxyagent, sentry-cli, bootc, sqlx, sdp-k8s-injector, vector, deno, rustup, rustls-openssl-client...