cve-tarmageddon

CVE-2025-62518: TARmageddon Questo repository dimostra un bug critico in tokio-tar e nelle librerie Rust async correlate per tar, dove gli override della dimensione size dell'header esteso PAX non vengono applicati prima di calcolare la posizione dell'header successivo. Riepilogo del Bug Causa...

NeuroSploit

🧠 NeuroSploit v4.0.0...

GHSA-3GJW-F78C-VVPW tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking tryget, and both Row and...

tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking tryget, and both Row and...

postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

darwis-taxii

DARWIS TAXII Un server TAXII Trusted Automated eXchange of Indicator Information ad alte prestazioni scritto in Rust. Porting in Rust di EclecticIQ OpenTAXII con piena compatibilità del database. Funzionalità TAXII 1.x - Discovery, Poll, Inbox, Collection Management, Subscriptions TAXII 2.1 - API...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-73489 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-73489 Source advisory: OSV:GHSA-CQJC-RMPQ-XPRQ...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-73430 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-73430 Source advisory: OSV:GHSA-5XVQ-CP9X-6P6R...

SUSE CVE-2026-32766

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping rather than rejection of invalid PAX extensions could be used as a building block for a parser...

CVE-2026-13699 Databroker 0.6.1 PublishValue missing data_point panic

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional datapoint field in PublishValueRequest. When a request contains a valid signalid but omits datapoint, the server directly calls unwrap on request.datapoint,...

EUVD-2026-43634

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional datapoint field in PublishValueRequest. When a request contains a valid signalid but omits datapoint, the server directly calls unwrap on request.datapoint,...

CVE-2026-13699

CVE-2026-13699 affects Eclipse KUKSA Databroker 0.6.1. The gRPC handler kuksa.val.v2.VAL/PublishValue fails to validate the optional data_point in PublishValueRequest; if signal_id is valid but data_point is omitted, the code dereferences request.data_point (unwrap) and panics in the Tokio worker...

PT-2026-57985

Name of the Vulnerable Software and Affected Versions Eclipse KUKSA Databroker version 0.6.1 Description The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data point field in PublishValueRequest. If a request includes a valid signal id but omits data...

RUSTSEC-2026-0179 Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime...

actix-postgres (>=0.1.0, <=0.4.0), actyxos_data_flow (0.1.0) +484 more potentially affected by unknown CVE via tokio-postgres (>=0.4.0-rc.2, <=0.7.17)

tokio-postgres CARGO version =0.4.0-rc.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.4.0, =0.1.1, =0.4.0, =0.3.5, =0.2.0, =0.13.2, =0.14.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0178...

Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-48110 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-48110 Source advisory: OSV:GHSA-4R3C-5HPG-58QR...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.6.0, <=0.8.11) +6 more potentially affected by CVE-2026-48107 via russh (>=0.37.1, <=0.43.0)

russh CARGO version =0.37.1, =0.6.0, =0.1.0, =0.1.0, =2.0.0-beta.1, =2.0.3 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-48107 Source advisory: OSV:GHSA-G9G7-5CGW-6V28...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46705 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46705 Source advisory: OSV:GHSA-HPV4-5H6F-WQR3...