PT-2026-53648

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj For more information see the GitHub-hosted security advisory...

SUSE SLED15 / SLES15 Security Update : rustup (SUSE-SU-2026:2441-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2441-1 advisory. This update for rustup fixes the following issues - CVE-2026-25727: time: parsing of user-provided input by the RFC 282...

Leak in WASIp1 `fd_renumber` implementation

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3p27-qvp9-27qf For more information see the GitHub-hosted security advisory...

ct-python (>=0.5.9, <=0.5.12), inline-python (>=0.14.0, <=0.14.4) +2 more potentially affected by unknown CVE via pyo3 (>=0.24.2, <=0.28.3)

pyo3 CARGO version =0.24.2, =0.5.9, =0.14.0, =0.14.0, =0.4.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0176...

foid (0.1.0), libcrux-ml-dsa (>=0.0.3, <=0.0.11) +7 more potentially affected by unknown CVE via pqcrypto-mldsa (0.1.2)

pqcrypto-mldsa CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pqcrypto-mldsa and may be impacted: - foid 0.1.0 - libcrux-ml-dsa =0.0.3, =0.18.0, =1.0.0-alpha.5, =1.0.0-alpha.7 - test-foo-bar-ml-dsa 0.0.9 - uvb-crypto-pqc 0.2.1 -...

dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), jxl-color (>=0.1.0, <=0.10.2) +8 more potentially affected by CVE-2026-52834 via jxl-grid (>=0.1.1, <=0.5.3)

jxl-grid CARGO version =0.1.1, =0.8.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0-rc0 Source cves: CVE-2026-52834 Source advisory: OSV:RUSTSEC-2026-0151...

libcrux-aead (>=0.0.4-pre.1, <=0.0.9-pre.1), libcrux-aes (0.0.9-pre.1) +19 more potentially affected by unknown CVE via libcrux-secrets (>=0.0.4-pre.1, <=0.0.6-pre.1)

libcrux-secrets CARGO version =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.4-pre.1, =0.0.8-pre.1 and more Source cves: unknown CVE Source advisory:...

audio-opus-bsd (>=0.1.0, <=0.1.2), audiopus (>=0.1.0, <=0.3.0-rc.0) +12 more potentially affected by unknown CVE via audiopus_sys (>=0.1.8, <=0.2.2)

audiopussys CARGO version =0.1.8, =0.1.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0, =0.1.32, =0.0.12, =0.9.0, =0.9.3 - zoog 0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0150...

RUSTSEC-2026-0235 Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice...

abc-rs (>=0.2.2, <=0.2.4), acid-rs (>=1.1.0, <=1.1.1) +993 more potentially affected by unknown CVE via git2 (>=0.1.21, <=0.20.4)

git2 CARGO version =0.1.21, =0.2.2, =1.1.0, =0.0.1, =0.2.0, =0.3.0, =1.0.0, =0.1.0, =2.0.0-rc.1, =0.2.0, =0.1.0, =0.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0183...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.7) +114 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =0.1.0-beta.2, =0.2.0 - fluxbench-logic 0.2.0 - fluxbench-report 0.2.0 and more Sour...

Fedora 43 : rust-sequoia-git (2026-95ac9001e8)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-95ac9001e8 advisory. Update to version 0.6.0. Addresses RUSTSEC-2026-0109. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +803 more potentially affected by unknown CVE via sized-chunks (>=0.1.3, <=0.6.5)

sized-chunks CARGO version =0.1.3, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.15.0, =1.15.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0251...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +841 more potentially affected by unknown CVE via bitmaps (>=2.1.0, <=3.2.1)

bitmaps CARGO version =2.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.15.0, =0.2.0, =0.2.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0247...

accesskit_consumer (>=0.1.0, <=0.7.1), accesskit_windows (>=0.1.0, <=0.8.0) +658 more potentially affected by unknown CVE via im (>=9.0.0, <=15.1.0)

im CARGO version =9.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.5, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =1.15.0, =1.15.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0248...

adbyss_psl (>=0.3.5, <=0.3.7), afrim-translator (>=0.1.4, <=0.2.1) +433 more potentially affected by unknown CVE via smartstring (>=0.2.7, <=1.0.1)

smartstring CARGO version =0.2.7, =0.3.5, =0.1.4, =0.0.2, =0.0.3, =0.0.10, =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 - aquatichttploadtest 0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0249...

ansi2png-rs (>=0.1.0, <=0.1.1), artano (>=0.1.0, <=0.3.5) +55 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - img2text 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

ansi2png-rs (>=0.1.0, <=0.1.1), artano (>=0.1.0, <=0.3.5) +55 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - img2text 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0116...

ach (>=0.1.0, <=0.2.5), ach-array (>=0.1.0, <=0.2.5) +1668 more potentially affected by unknown CVE via bare-metal (>=0.1.3, <=1.0.0)

bare-metal CARGO version =0.1.3, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.5.0, =0.5.0, =0.8.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0110...

air-interpreter-cid (>=0.1.0, <=0.4.0), bellscoin (>=0.28.2, <=0.31.0) +41 more potentially affected by unknown CVE via core2 (>=0.3.3, <=0.4.0)

core2 CARGO version =0.3.3, =0.1.0, =0.28.2, =0.7.0, =2.3.0, =0.1.4, =0.3.0, =0.1.2, =2.1.0, =0.1.0, =0.2.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0105...