1310 matches found
RUSTSEC-2025-0116 tandem_garble_interop is unmaintained
The tandem crates in https://github.com/sine-fdn are no longer maintained by the SINE Foundation. The repository has been archived. Recommended alternative We are continuing our work on SMPC by implementing our secure multi-party computation engine Polytune...
RUSTSEC-2025-0103 `unic-ucd-core` is unmaintained
All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained...
RUSTSEC-2025-0087 `unic-cli` is unmaintained
All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained...
RUSTSEC-2025-0088 `unic-idna-punycode` is unmaintained
All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained. Recommended alternatives - idna...
RUSTSEC-2025-0058 custom_derive crate is unmaintained
The customderive crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives - strum - macro-attr...
RUSTSEC-2025-0056 adler crate is unmaintained, use adler2 instead
The adler crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives - adler2...
RUSTSEC-2025-0016 Use after free in `Parc` and `Prc` due to missing lifetime constraints
Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could...
RUSTSEC-2025-0029 totally-safe introduces memory vulnerabilities in safe Rust
totally-safe provides unsound APIs that exploit a soundness bug in rustc: https://github.com/rust-lang/rust/issues/25860...
RUSTSEC-2025-0028 cve-rs introduces memory vulnerabilities in safe Rust
This crate is a joke and should never be used. cve-rs provides demonstrations of common memory vulnerabilities such as buffer overflows and segfaults implemented completely within safe Rust. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc:...
RUSTSEC-2025-0158 `jfrog_quotes` was removed from crates.io for malicious code
jfrogquotes was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...
RUSTSEC-2025-0160 `custom-req-on-workers` was removed from crates.io for malicious code
custom-req-on-workers was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...
RUSTSEC-2024-0431 Unsound usages of `core::slice::from_raw_parts`
We consider asslice and asslicemut unsound because: the pointer with any bit patterns could be cast to the slice of arbitrary types. The pointer could be created by unsafe new and deprecated fromparts. We consider that fromparts should be removed in latest version because it will help trigger...
RUSTSEC-2024-0426 Unsound usages of `u8` type casting
The library provides a safe public API unpack to cast u8 array to arbitrary types, which can cause to undefined behaviors. The length check of array can only prevent out-of-bound access on the return type. However, it can't prevent misaligned pointer when casting u8 pointer to a type aligned to...
RUSTSEC-2024-0435 Unsound usages of `Vec::from_raw_parts`
The library provides a public safe API transmutevecasbytes, which incorrectly assumes that any generic type T could have stable layout, causing to uninitialized memory exposure if the users pass any types with padding bytes as T and cast it to u8 pointer. In the issue, we develop a PoC to show...
RUSTSEC-2024-0424 Unsound usages of `core::slice::from_raw_parts_mut`
The library breaks the safety assumptions when using unsafe API slice::fromrawpartsmut. The pointer passed to fromrawpartsmut is misaligned by casting u8 to u16 raw pointer directly, which is unsound. The bug is patched by using alignoffset, which could make sure the memory address is aligned to ...
RUSTSEC-2024-0445 cap-primitives doesn't fully sandbox all the Windows device filenames
Impact cap-primitives's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", a...
RUSTSEC-2024-0402 Borsh serialization of HashMap is non-canonical
The borsh serialization of the HashMap did not follow the borsh specification. It potentially produced non-canonical encodings dependent on insertion order. It also did not perform canonicty checks on decoding. This can result in consensus splits and cause equivalent objects to be considered...
RUSTSEC-2024-0376 Remotely exploitable Denial of Service in Tonic
Impact When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit. More...
RUSTSEC-2024-0374 Segmentation fault due to use of uninitialized memory
When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convertzipdatetime". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the...
RUSTSEC-2024-0427 get-size-derive is unmaintained
get-size-derive's maintainer seems to be unreachable, with no commits and releases pushed for 1 year and no activity on the GitHub repo. get-size-derive also depends on attribute-derive ^0.6 a version of the crate which uses the yanked crate proc-macro-error. Possible Alternatives - get-size-deri...
RUSTSEC-2024-0370 proc-macro-error is unmaintained
proc-macro-error's maintainer seems to be unreachable, with no commits for 2 years, no releases pushed for 4 years, and no activity on the GitLab repo or response to email. proc-macro-error also depends on syn 1.x, which may be bringing duplicate dependencies into dependant build trees. Possible...
RUSTSEC-2024-0366 CWA-2023-004: Excessive number of function parameters in compiled Wasm
A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see...
RUSTSEC-2024-0446 Shell expansion in custom commands
Summary Undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Details I wanted to show the git commit name in my prompt I use bash, so I added a command: custom.gitcommitname comma...
RUSTSEC-2024-0394 mmap unmaintained
The mmap crate is unmaintained as its repository has been archived on Feb 10, 2022. The main alternative seems to be memmap2 crate...
RUSTSEC-2024-0406 BTreeMap memory leak when deallocating nodes with overflows
When storing unbounded types in a BTreeMap, a node is represented as a linked list of "memory chunks". In some cases, when we deallocate a node only the first memory chunk is deallocated, and the rest of the memory chunks remain incorrectly allocated, causing a memory leak. In the worst case,...
RUSTSEC-2024-0334 `libp2p-tokio-socks5` is unmaintained
Note the repository was archived without an issue so we link directly to the commit that marked the repository as unmaintained. To the best of the original authors knowledge the crate has no vulnerabilities as of the last release, it is just unmaintained due to laziness - new maintainer welcome...
RUSTSEC-2024-0419 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2024-0396 `conrod_core` is unmaintained
The conrodcore crate is no longer maintained. The author suggests egui as a potential alternative...
RUSTSEC-2024-0004 `cosmwasm` is unmaintained
The crate cosmwasm is not used anymore since spring 2020. The functionality was split in multiple different crates, such as the standard library cosmwasm-std and the virtual machine cosmwasm-vm. An overview can be found in the cosmwasm repository. If you have this crate in your dependency tree,...
RUSTSEC-2023-0117 `tauri-winrt-notifications` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user gabielle55131 to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...
RUSTSEC-2023-0122 `winx-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0116 `registry-win` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0121 `libusb1-main` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0106 `lfest-main` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0120 `windows-service-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0114 `tiny-server` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...
RUSTSEC-2023-0104 `littest` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...
RUSTSEC-2023-0100 `xrvrv` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user amaperf and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download recor...
RUSTSEC-2023-0033 Parsing borsh messages with ZST which are not-copy/clone is unsound
Affected versions of borsh cause undefined behavior when zero-sized-types ZST are parsed and the Copy/Clone traits are not implemented/derived. For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy this can be achieved through a singleton, then accessing/writing to...
RUSTSEC-2023-0050 multipart is Unmaintained
The multipart crate is unmaintained. The author has archived the github repository. Alternatives: - multer - multiparty...
RUSTSEC-2023-0031 Initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers
Once::trycallonce is unsound if invoked more than once concurrently and any call fails to initialise successfully...
RUSTSEC-2023-0016 Possible out-of-bounds read in release mode
Affected versions of this crate were using a debug assertion to validate the last parameter of partialsort. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions. All writes are bounds-checked, so the out-of-bounds...
RUSTSEC-2022-0050 Interledger is Unmaintained
Interledger family of crates is not being actively maintained anymore. The owner of the published crate does not appear to be responsive. There is an outstanding concern around username comparison. This concern may or may not be resolved by bumping up the dependencies of the project...
RUSTSEC-2022-0046 Out-of-bounds read when opening multiple column families with TTL
Affected versions of this crate called the RocksDB C API rocksdbopencolumnfamilieswithttl with a pointer to a single integer TTL value, but one TTL value for each column family is expected. This is only relevant when using rocksdb::DBWithThreadMode::opencfdescriptorswithttl with multiple column...
RUSTSEC-2022-0016 Use after free with `externref`s and epoch interruption in Wasmtime
Use after free with externrefs and epoch interruption in Wasmtime...
RUSTSEC-2022-0012 Arrow2 allows double free in `safe` code
The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...
RUSTSEC-2022-0103 Incorrect signature verification on gzip-compressed install images
The coreos-installer is a program to fetch a disk image and stream it to a target disk. During the installation process the installation image gpg signatures are verified. The signature verification can be bypassed for gzip-compressed images due to a flaw in gzip coreos-installer wrapper. When th...
RUSTSEC-2022-0096 Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-88xq-w8cq-xfg7. For more information see the GitHub-hosted security advisory...
RUSTSEC-2021-0025 crate has been renamed to `qjsonrpc`
This crate has been renamed from jsonrpc-quic to qjsonrpc. The new repository location is:...
RUSTSEC-2021-0135 Improper validation of Windows paths could lead to directory traversal attack
towerhttp::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only...