rustsec

RustSec クレート 🦀🛡️📦 RustSec アドバイザリデータベースは、crates.io で公開されている Rust クレートに対して報告されたセキュリティアドバイザリをまとめたリポジトリです。 アドバイザリデータベース自体は、以下で参照できます: https://github.com/RustSec/advisory-db このリポジトリについて このリポジトリには、RustSec プロジェクトが保守しているすべてのクレートを含む Cargo ワークスペースが格納されています: 名前| 説明| クレート| ドキュメント| ビルド ---|---|---|---|---...

checkout-index

checkout-index - CVE-2025-22620の再現コード これは RUSTSEC-2025-0001 CVE-2025-22620、GHSA-fqmf-w4xh-33rh の概念実証コードです。勧告と同じコードですが、Rustプロジェクトの形式で、Cargo.toml と Cargo.lock が含まれています。 このリポジトリは勧告の執筆中に役立ちましたが、たまに他の人にも役立つかもしれないと思いました。ただし、これは勧告よりもはるかに興味が持たれないでしょう。また、これは勧告の情報の代わりになるものではありません。勧告に記載されているように、脆弱性は...

Fedora 46 : rust-librsvg / rust-xml5ever (2026-d804dc1feb)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-d804dc1feb advisory. - Update the librsvg crate to version 2.63.2. - Update the xml5ever crate to version 0.39.0. This includes fixes for RUSTSEC-2026-0305. Tenable has extracted...

Fedora 43 : rust-lru / rust-lru0.16 (2026-332a62112c)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-332a62112c advisory. Update lru crate to version 0.18.4 and add a compat package for version 0.16. This fixes an obscure potential use-after-free issue: Rebuild tracker: Tenable...

rustsec platforms/v4.2.0

RustSec Crates 🦀🛡️📦 The RustSec Advisory Database is a repository of security advisories filed against Rust crates published via crates.io. The advisory database itself can be found at: https://github.com/RustSec/advisory-db About this repository This repository contains a Cargo Workspace with all...

Fedora 46 : rust-lru / rust-lru0.16 (2026-a4ab790e17)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-a4ab790e17 advisory. Update lru crate to version 0.18.4 and add a compat package for version 0.16. This fixes an obscure potential use-after-free issue: Rebuild tracker: Tenable...

Fedora 44 : rust-webbrowser (2026-0272e561a4)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0272e561a4 advisory. Update to version 1.2.4. This includes a fix for RUSTSEC-2026-0257. Tenable has extracted the preceding description block directly from the Fedora security...

sp-im (>=0.2.0, <=0.3.0), yatima-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via sp-sized-chunks (0.1.0)

sp-sized-chunks CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sp-sized-chunks and may be impacted: - sp-im =0.2.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0270...

sp-im (>=0.2.0, <=0.3.0), yatima-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via sp-sized-chunks (0.1.0)

sp-sized-chunks CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sp-sized-chunks and may be impacted: - sp-im =0.2.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0254...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +1176 more potentially affected by unknown CVE via sized-chunks (>=0.1.3, <=0.6.5)

sized-chunks CARGO version =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.0.5, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =0.0.1, =0.0.1, =0.0.0-alpha, =0.0.0-alpha.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0255...

afxdp (>=0.3.0, <=0.4.0), augmented_baseview (>=0.1.0, <=0.1.3) +27 more potentially affected by unknown CVE via rtrb (>=0.1.4, <=0.2.3)

rtrb CARGO version =0.1.4, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.0, =0.8.0, =0.8.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0274...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0227...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0228...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0230...

RUSTSEC-2026-0223 Preemption and traps during bulk operations enable breaking internal VM state

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q For more information see the GitHub-hosted security advisory...

chatgpt-panic-hook (>=0.1.1, <=0.1.5), formation-chess-web (0.2.0) +5 more potentially affected by unknown CVE via webbrowser (1.0.0)

webbrowser CARGO version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on webbrowser and may be impacted: - chatgpt-panic-hook =0.1.1, =0.2.0, =0.13.2, =0.1.0, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0257...

abscissa (>=0.4.0, <=0.6.0-pre.1), abscissa_core (>=0.4.0, <=0.6.0-pre.1) +121 more potentially affected by unknown CVE via gumdrop (>=0.1.0, <=0.8.1)

gumdrop CARGO version =0.1.0, =0.4.0, =0.4.0, =0.5.0, =0.1.1, =0.1.0, =0.2.0, =1.0.0, =1.0.6, =1.0.8, =1.0.9, =1.0.9, =1.0.12 - amdguid-glium 1.0.13 - amdguid-glow 1.0.13 - amdguid-wayland 1.0.13 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0214...

libcrux-aead (>=0.0.4-pre.1, <=0.0.8) potentially affected by unknown CVE via libcrux-aesgcm (>=0.0.4, <=0.0.8-rc.2)

libcrux-aesgcm CARGO version =0.0.4, =0.0.4-pre.1, =0.0.8 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0211...

blyss-rs (0.2.0), lunarbase-pmm-math (>=0.1.0, <=0.2.6) +10 more potentially affected by unknown CVE via ruint (>=1.8.0, <=1.17.2)

ruint CARGO version =1.8.0, =0.1.0, =22.0.2, =22.2.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0220...

aabb_physics (>=0.1.0, <=0.1.1), aad (>=0.2.1, <=0.9.0) +2097 more potentially affected by unknown CVE via ttf-parser (>=0.1.0, <=0.25.1)

ttf-parser CARGO version =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.0, =0.0.2, =0.1.2, =0.1.1, =0.1.26, =0.1.23, =0.1.9, =0.2.0, =0.0.10, =0.0.18 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0192...