cve-tarmageddon

CVE-2025-62518: TARmageddon This repository demonstrates a critical bug in tokio-tar and related async Rust tar libraries where PAX extended header size overrides are not applied before calculating the next header position. Bug Summary Root Cause: When processing tar files with PAX extended heade...

darwis-taxii

DARWIS TAXII A high-performance TAXII Trusted Automated eXchange of Indicator Information server written in Rust. Rust port of EclecticIQ OpenTAXII with full database compatibility. Features TAXII 1.x - Discovery, Poll, Inbox, Collection Management, Subscriptions TAXII 2.1 - Full REST API with...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

CVE-2026-104431

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

CVE-2026-104431 Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

CVE-2026-104431 Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

CVE-2026-104431

Versions of Zebra prior to 6.0.0 are vulnerable to a denial of service (DoS) condition. The root cause is a vulnerability where unauthenticated peers can stall Tokio workers by submitting mempool transactions that require expensive synchronous script verification . Specifically, attackers can tra...

EUVD-2026-91442

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

CVE-2026-104431 Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

PT-2026-104242

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

CVE-2026-104431: Asymmetric Resource Consumption (Amplification)

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-102821 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-102821 Source advisory: OSV:GHSA-35G8-35P8-C8FW...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-102823 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-102823 Source advisory: OSV:GHSA-47HW-GVQ5-R2GM...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-102824 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-102824 Source advisory: OSV:GHSA-W3JG-PJXF-73P4...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-102825 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-102825 Source advisory: OSV:GHSA-G6XM-F9XP-QQ35...

NeuroSploit

🧠 NeuroSploit v4.0.0...

WS-2026-0039

A malicious, compromised, or man-in-the-middle PostgreSQL server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs the key derivation inline with no upper bound, pinning a tokio worker thread for minutes per connection and possibly stallin...

actix-postgres (>=0.1.0, <=0.4.0), actyxos_data_flow (0.1.0) +503 more potentially affected by unknown CVE via tokio-postgres (>=0.4.0-rc.2, <=0.7.17)

tokio-postgres CARGO version =0.4.0-rc.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.4.0, =0.1.1, =0.4.0, =0.3.5, =0.2.0, =0.13.2, =0.14.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-3GJW-F78C-VVPW...

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking tryget, and both Row and...

GHSA-3GJW-F78C-VVPW tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking tryget, and both Row and...