RUSTSEC-2024-0359 The kstring integration in gix-attributes is unsound

gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...

The kstring integration in gix-attributes is unsound

gix-attributes in state::ValueRef unsafely creates a &str from a &u8 containing non-UTF8 data, with the justification that so long as nothing reads the &str and relies on it being UTF-8 in the &str, there is no UB: rust // SAFETY: our API makes accessing that value as str impossible, so illformed...

Fedora: Security Advisory for rust-pythonize (FEDORA-2024-3ff83cb806)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for rust-pythonize (FEDORA-2024-d408b654d6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: rust-pythonize-0.21.1-1.fc40

Serde Serializer & Deserializer from Rust Python, backed by PyO3...

[SECURITY] Fedora 38 Update: rust-pythonize-0.21.1-1.fc38

Serde Serializer & Deserializer from Rust Python, backed by PyO3...

[SECURITY] Fedora 39 Update: rust-pythonize-0.21.1-1.fc39

Serde Serializer & Deserializer from Rust Python, backed by PyO3...

anchor-token (>=0.0.1 <=0.3.0-alpha.1), archid-marketplace (>=1.0.5 <=1.0.8) +150 more potentially affected by CVE-2024-58264 via serde-json-wasm (>=0.1.3 <=0.4.1)

serde-json-wasm CARGO version =0.1.3, =0.0.1, =1.0.5, =1.0.0, =1.0.0, =0.3.1, =0.1.0, =2.5.2, =0.1.0, =1.0.0, =0.4.0, =1.0.0, =2.2.0-rc3 - cosmwasm-contract-migratable-std =0.1.0 and more Source cves: CVE-2024-58264 Source advisory: OSV:GHSA-RR69-RXR6-8QWF...

serde-json-wasm stack overflow during recursive JSON parsing

When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth...

GHSA-RR69-RXR6-8QWF serde-json-wasm stack overflow during recursive JSON parsing

When parsing untrusted, deeply nested JSON, the stack may overflow, possibly enabling a Denial of Service attack. This was fixed by adding a check for recursion depth...

anchor-token (>=0.0.1 <=0.3.0-alpha.1), archid-marketplace (>=1.0.5 <=1.0.8) +150 more potentially affected by CVE-2024-58264 via serde-json-wasm (>=0.1.3 <=0.4.1)

serde-json-wasm CARGO version =0.1.3, =0.0.1, =1.0.5, =1.0.0, =1.0.0, =0.3.1, =0.1.0, =2.5.2, =0.1.0, =1.0.0, =0.4.0, =1.0.0, =2.2.0-rc3 - cosmwasm-contract-migratable-std =0.1.0 and more Source cves: CVE-2024-58264 Source advisory: OSV:RUSTSEC-2024-0012...

PT-2025-31022 · Pypi · Serde-Json-Wasm

Name of the Vulnerable Software and Affected Versions: serde-json-wasm versions prior to 1.0.1 Description: The serde-json-wasm crate is susceptible to a stack consumption issue when processing deeply nested JSON data. Recommendations: Update to version 1.0.1 or later...

CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

CVE-2023-50711 `serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access

vmm-sys-util is a collection of modules that provides helpers and utilities used by multiple rust-vmm components. Starting in version 0.5.0 and prior to version 0.12.0, an issue in the FamStructWrapper::deserialize implementation provided by the crate for vmmsysutil::fam::FamStructWrapper can lea...

Fedora: Security Advisory for rust-pythonize (FEDORA-2023-c0696d7b53)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: rust-pythonize-0.19.0-1.fc37

Serde Serializer & Deserializer from Rust Python, backed by PyO3...

GHSA-255R-3PRX-MF99 `rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8

It was found that Raw::fromutf8 expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash...

ably (=0.1.0), acid-store (>=0.1.0 <=0.13.0) +416 more potentially affected by unknown CVE via rmp-serde (>=0.14.4 <=0.15.5)

rmp-serde CARGO version =0.14.4, =0.1.0, =0.4.3, =0.1.0, =0.8.0, =0.0.1, =0.0.2, =1.1.0, =1.0.1, =0.2.0, =0.3.0 - algonautcore =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-255R-3PRX-MF99...

`rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8

It was found that Raw::fromutf8 expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash...

Malicious Package

Overview middleware-serde is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...