1310 matches found
RUSTSEC-2025-0076 `unic-ucd-name` is unmaintained
All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained...
RUSTSEC-2025-0000 matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method
In matrix-sdk-base before 0.14.1, calling the RoomMember::normalizedpowerlevel method can cause a panic if a room member has a power level of Int::Min...
RUSTSEC-2025-0138 --allow-read / --allow-write permission bypass in `node:sqlite`
It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement. PoC // poc.js import DatabaseSync from "node:sqlite" const db = new DatabaseSync":memory:"; db.exec"ATTACH DATABASE 'test.db' as test;"; db.exec"CREATE TABLE test.test id INTEGER PRIMARY KEY, name...
RUSTSEC-2025-0019 `array-init-cursor` in version 0.2.0 and below is unsound when used with types that implement `Drop`
The Drop implementation will get run twice when using the cursor. This issue does not affect you, if you are using only using the crate with types that are Copy such as u8. This issue also does not affect you, if you are only depending on it through the crate planus...
RUSTSEC-2025-0017 The `trust-dns` project has been rebranded to `hickory-dns`
The trust-dns-proto crate is now available as hickory-proto...
RUSTSEC-2024-0423 gtk-layer-shell-sys GTK3 bindings - no longer maintained
The gtk-layer-shell-sys GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-layer-shell instead...
RUSTSEC-2024-0378 Risk of use-after-free in `borrowed` reads from Python weak references
The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling. In PyO3 0.22.4...
RUSTSEC-2024-0440 Runtime crash when combining tail calls with stack traces
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q8hx-mm92-4wvg. For more information see the GitHub-hosted security advisory...
RUSTSEC-2024-0419 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2024-0010 Improper comparison of different-length signatures
The Webhook::verify function incorrectly compared signatures of different lengths - the two signatures would only be compared up to the length of the shorter signature. This allowed an attacker to pass in v1, as the signature, which would always pass verification...
RUSTSEC-2023-0074 Some Ref methods are unsound with some type parameters
The Ref methods intoref, intomut, intoslice, and intoslicemut are unsound and may allow safe code to exhibit undefined behavior when used with Ref where B is cell::Ref or cell::RefMut. Note that these methods remain sound when used with B types other than cell::Ref or cell::RefMut. See...
RUSTSEC-2023-0047 impl `FromMdbValue` for bool is unsound
The implementation of FromMdbValue have several unsoundness issues. First of all, it allows to reinterpret arbitrary bytes as a bool and could make undefined behavior happen with safe function. Secondly, it allows transmuting pointer without taking memory layout into consideration. The details of...
RUSTSEC-2023-0032 Unsound FFI: Wrong API usage causes write past allocated area
The following usage causes undefined behavior. rust let kp: ntru::types::KeyPair = …; kp.getpublic.exportDefault::default When compiled with debug assertions, the code above will trigger a attempt to subtract with overflow panic before UB occurs. Other mistakes e.g. using EncParams from a differe...
RUSTSEC-2023-0093 Miscompilation of `i8x16.select` with the same inputs on x86\_64
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xm67-587q-r2vw. For more information see the GitHub-hosted security advisory...
RUSTSEC-2023-0015 Ascii allows out-of-bounds array indexing in safe code
Affected version of this crate had implementation of From for &mut u8 and &mut str. This can result in out-of-bounds array indexing in safe code. The flaw was corrected in commit 8a6c779 by removing those impls...
RUSTSEC-2022-0021 `SegQueue` creates zero value of any type
Affected versions of this crate called mem::zeroed to create values of a user-supplied type T. This is unsound e.g. if T is a reference type which must be non-null. The flaw was corrected by avoiding the use of mem::zeroed, using MaybeUninit instead...
RUSTSEC-2021-0153 `encoding` is unmaintained
Last release was on 2016-08-28. The issue inquiring as to the status of the crate has gone unanswered by the maintainer. Possible alternatives - encodingrs...
RUSTSEC-2021-0150 ncollide3d is unmaintained
The maintainer has advised that this crate is passively-maintained and that it is being superseded by the Parry project...
RUSTSEC-2020-0162 `tokio-proto` is deprecated/unmaintained
The tokio-proto crate has been deprecated, and its GitHub repository has been archived. Users may be interested in tokio-tower instead, per https://github.com/tokio-rs/tokio/issues/118issuecomment-452969665...
RUSTSEC-2018-0005 Uncontrolled recursion leads to abort in deserialization
Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth...
RUSTSEC-2026-0322 Excessive allocated memory on the host when guests don't have stdio
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0303 `stack-graphs` is archived and unmaintained
The upstream repository github/stack-graphs has been archived. Issues and pull requests are disabled, so maintainers cannot be reached there. The last crates.io release is 0.14.1 2024-12-13. The repository's last push was 2025-09-09. There is no published successor...
RUSTSEC-2026-0299 `owned-alloc` is unmaintained
The owned-alloc crate has had no release since 2018, and the maintainer has not responded to the upstream issue or to direct contact...
RUSTSEC-2026-0281 `greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...
RUSTSEC-2026-0267 Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
BitVecCore::clear drops every occupied element with dropinplace and only afterwards clears the occupancy bits and resets len. If an element's Drop panics, those metadata updates are skipped, so the slot of the already-dropped element stays marked as occupied. BitVecCore::drop calls clear again,...
RUSTSEC-2026-0268 Guest controlled-size host heap allocation through WASIp3 streams
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-x84v-gj2h-g759 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0271 FTP command injection via CRLF in control channel arguments
Affected versions of suppaftp wrote command arguments user name, password, paths, SITE arguments and custom commands to the FTP control channel without validation. An argument containing a carriage return \r or a line feed \n terminated the intended command line and let a second, attacker-chosen...
RUSTSEC-2026-0238 Low-level GCM ignores the operation nonce
In all published versions of dcrypt-algorithms before 2.0.0, the low-level Gcm builder required an operation nonce but derived J0 from the nonce captured by the original Gcm constructor. Multiple operations could therefore silently reuse a nonce even when callers supplied distinct values,...
RUSTSEC-2026-0230 Empty NIP-50 search filters can panic
The NIP-50 event-matching path searched event content with slice::windowssearch.len. An empty search string therefore called slice::windows0, which always panics instead of returning a match result. A remote client able to submit filters to an application using this matcher could trigger the pani...
RUSTSEC-2026-0251 sized-chunks is unmaintained
The sized-chunks crate is unmaintained; all versions are affected. The GitHub repository was archived by the owner on 2026-05-03. Recommended alternative: imbl-sized-chunks, a popular fork of this crate...
RUSTSEC-2026-0128 Double-free and use-after-free in `Keys::next()`
Keys::next uses ptr::read to move out the Option by value, which drops the contained V when V is non-Copy e.g. String. This leaves a dangling value in the map's storage slot. Subsequent get operations on that key return a dangling reference to already-freed memory. This can be triggered through...
RUSTSEC-2026-0132 Potential out-of-bounds write via public `Context` fields
The Context struct has all fields public pub dlen, pub digest, etc.. Code from other modules within the same crate can directly modify dlen to a value exceeding the digest vector length. When reset is subsequently called, self.digestself.dlen as usize = 0 becomes an out-of-bounds write. Withdrawa...
RUSTSEC-2026-0118 NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses
The NSEC3 closest-encloser proof validation in hickory-proto's DnssecDnsHandle walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the S...
RUSTSEC-2026-0126 AVX2 Implementation Did Not Fully Reduce Intermediate Values
The AVX2 implementation of ML-DSA did not fully reduce intermediate inputs to the inverse NTT, which leads to a testable difference in panic behaviour of internal functions compared to the portable implementation. Impact We are not aware of inputs to the public key generation, signing or...
RUSTSEC-2026-0137 Possible unaligned data access for implementations of `SqliteAggregate`
Diesel allows to register custom aggregate SQL functions for SQLite via the SqliteAggregate interface. To store an instance of the custom aggregate processor Diesel relied on the sqlite3aggregatecontext function provided by sqlite. This function doesn't provide any guarantees about alignment of t...
RUSTSEC-2026-0103 Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
A Double Free / Use-After-Free UAF vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin-vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code - no unsafe blocks required. Undefined...
RUSTSEC-2026-0105 core2 is unmaintained, all versions yanked
The maintainer decided stop maintaining crate and yanked all published versions. Potential alternatives: - embedded-io solves the same general problem - no-std-io2 is a maintained fork...
RUSTSEC-2026-0084 `logprinter` was removed from crates.io for malicious code
The crate downloaded code from an external HTTP endpoint and executed it within its trace fn...
RUSTSEC-2026-0053 `tokio-tls` is unmaintained
The tokio-tls crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0051 `tokio-threadpool` is unmaintained
The tokio-threadpool crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC
A logic error in CRL distribution point matching in AWS-LC allows a revoked certificate to bypass revocation checks during certificate validation, when the application enables CRL checking and uses partitioned CRLs with Issuing Distribution Point IDP extensions. Customers of AWS services do not...
RUSTSEC-2026-0037 Denial of service in Quinn endpoints
Receiving QUIC transport parameters containing invalid values could lead to a panic. Unfortunately the maintainers did not properly assess usage of unwrap calls in the transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this issue. We have since added a...
RUSTSEC-2026-0036 `time-sync` was removed from crates.io due to malicious code
The time-sync crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. This the same attack that we've seen three times in the last few days. The malicious crate had 1 version published on 2026-03-04 approximately 50 minutes before...
RUSTSEC-2026-0027 `tracings` was removed from crates.io for malicious code
This is part of an ongoing campaign to attempt to typosquat crates in an attempt to exfiltrate Polymarket credentials. The malicious crate had 1 version published on 2026-02-26 approximately 9 hours before removal and had no evidence of actual usage. The only crate depending on this crate was the...
RUSTSEC-2026-0069 Incorrect Length Encoding on KDF Export
Passing values length 65535 to Context::export produces output that disagrees with the RFC 9180 label encoding. In particular the length value is cast to u16 truncating any value exceeding 65535. Impact Applications that use hpke-rs to export very large secrets would experience interoperability...
RUSTSEC-2025-0167 `Bitmap::try_from(&[u8])` can create invalid values
The TryFrom implementation for Bitmap copies the input bytes into an uninitialized backing store and calls assumeinit without validating that the bytes form a valid value of the backing store type. For SIZE = 1 the backing store is a bool, so any input byte other than 0x00 or 0x01 produces an...
RUSTSEC-2025-0154 `replit_ruspty` was removed from crates.io for malicious code
The OpenSSF Package Analysis project identified 'replitruspty' @ 1.0.0 crates.io as malicious. Version 2.0.0 was also published with malware. It is considered malicious because: The package communicates with a domain associated with malicious activity. The package executes one or more commands...
RUSTSEC-2025-0111 `tokio-tar` parses PAX extended headers incorrectly, allows file smuggling
The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size size=000000000000, while a PAX header specifies a non-zero size, tokio-tar::Archive is going to read the file content as tar entry header. This can be used by a tar file to present...