1310 matches found
RUSTSEC-2025-0115 tandem_http_server is unmaintained
The tandem crates in https://github.com/sine-fdn are no longer maintained by the SINE Foundation. The repository has been archived. Recommended alternative We are continuing our work on SMPC by implementing our secure multi-party computation engine Polytune...
RUSTSEC-2025-0105 Uninitialized memory exposure in create_ring_buffer
The safe function createringbuffer allocates a buffer using Vec::withcapacity followed by setlen, creating a Box containing uninitialized memory. This leads to undefined behavior when functions like writeslices create typed slices e.g., &mut bool over the uninitialized memory, violating Rust's...
RUSTSEC-2025-0102 `unic-ucd-age` is unmaintained
All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained...
RUSTSEC-2025-0126 Heap-buffer-overflow in nftnl::Batch::with_page_size (nftnl-rs)
A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::withpagesize constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-of-bounds writes during batch...
RUSTSEC-2025-0072 soundness issue and unmaintained
All functions under wrflib::byteextract are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. wrflib is unmaintained...
RUSTSEC-2025-0018 Potential out-of-bounds read with a malformed ELF file and the HashTable API.
Affected versions of this crate only validated the index argument of HashTable::getbucket and HashTable::getchain against the input-controlled bucketcount and chaincount fields, but not against the size of the ELF section. As a result, a malformed ELF file could trigger out-of-bounds reads in a...
RUSTSEC-2025-0011 `openpgp-card-sequoia` is unmaintained.
The openpgp-card-sequoia crate is no longer actively maintained. You can use the openpgp-card-rpgp crate for OpenPGP card client functionality instead...
RUSTSEC-2024-0433 Malicious plugin names, recipients, or identities can cause arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided through an attacker-controlled input to the following age APIs when the plugin feature flag is enabled: - age::plugin::Identity::fromstr or equivalently str::parse:: ...
RUSTSEC-2024-0437 Crash due to uncontrolled recursion in protobuf crate
Affected version of this crate did not properly parse unknown fields when parsing a user-supplied input. This allows an attacker to cause a stack overflow when parsing the mssage on untrusted data...
RUSTSEC-2024-0380 Replaced by `pqcrypto-mldsa`
This crate has been replaced by pqcrypto-mldsa, which provides a FIPS204-compatible implementation of ML-DSA...
RUSTSEC-2024-0425 get-size is unmaintained
get-size's maintainer seems to be unreachable, with no commits and releases pushed for 1 year and no activity on the GitHub repo. get-size also depends on get-size-derive 0.1.3, which uses attribute-derive ^0.6 a version of the crate which uses the yanked crate proc-macro-error. Possible...
RUSTSEC-2024-0384 `instant` is unmaintained
This crate is no longer maintained, and the author recommends using the maintained web-time crate instead. web-time: https://crates.io/crates/web-time...
RUSTSEC-2024-0385 `cw0` is unmaintained
The crate cw0 was first renamed to utils in 2021 and then to cw-utils because utils was already claimed on crates.io. The crate cw0 is not maintained anymore since then and should be replaced with cw-utils...
RUSTSEC-2024-0390 minitrace is Unmaintained
The minitrace maintainers have decided to continue the development of minitrace under a new organizational structure to improve community governance. In the meantime, minitrace will no longer be maintained. For more details, refer to tikv/minitrace-rust229. Possible Alternatives fastrace is...
RUSTSEC-2024-0403 op_panic in the base runtime can force a panic in the runtime's containing thread
Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic...
RUSTSEC-2024-0345 Low severity (DoS) vulnerability in sequoia-openpgp
There is a denial-of-service vulnerability in sequoia-openpgp, our crate providing a low-level interface to our OpenPGP implementation. When triggered, the process will enter an infinite loop. Many thanks to Andrew Gallagher for disclosing the issue to us. Impact Any software directly or indirect...
RUSTSEC-2024-0337 The crate `zip_next` has been renamed to `zip`.
Please switch to the new name. zipnext will receive no further releases...
RUSTSEC-2024-0429 Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`
The VariantStrIter::implget function called internally by implementations of the Iterator and DoubleEndedIterator traits for this type was unsound, resulting in undefined behaviour. An immutable reference &p to a mut libc::cchar pointer initialized to NULL was passed as an argument to a C functio...
RUSTSEC-2024-0417 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2024-0413 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2024-0415 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2024-0397 `conrod` is unmaintained
The crate conrod has been deprecated since version 0.62.0 released in December 2018. The functionality was split across multiple different crates, with the core functionality being transferred to conrodcore. An overview can be found in the conrod repository. If you have this crate in your...
RUSTSEC-2023-0072 `openssl` `X509StoreRef::objects` is unsound
This function returned a shared reference into an OpenSSL datastructure but did not account for interior mutability. OpenSSL may modify the data behind this reference, meaning accesses can race and the reference is unsound. Use of this function should be replaced with X509StoreRef::allcertificate...
RUSTSEC-2023-0108 `tauri-win-rt-notification` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user gabielle55131 to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer...
RUSTSEC-2023-0115 `acceptxmr-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0088 `loopdev` crate is unmaintained; use 'loopdev-3` instead.
The loopdev crate was last released in Oct, 2021. It has been unable to build in Fedora 38 and above since April, 2023. The loopdev-3 crate is a maintained fork: https://github.com/stratis-storage/loopdev-3...
RUSTSEC-2023-0084 `hpack` is unmaintained
The hpack crate is no longer maintained. Consider using fluke-hpack or httlib-huffman...
RUSTSEC-2023-0089 atomic-polyfill is unmaintained
The author has archived the GitHub repository and mentions deprecation in project's README. Possible alternatives portable-atomic...
RUSTSEC-2022-0094 Mimalloc Can Allocate Memory with Bad Alignment
This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons. Since then, the mimalloc allocator's logic changed, making it break this promise. This caused this crate to return...
RUSTSEC-2022-0023 `static_type_map` has been renamed to `erased_set`
Please use the erasedset crate going forward: There will be no further releases of statictypemap...
RUSTSEC-2022-0099 Use after free with `externref`s and epoch interruption in Wasmtime
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gwc9-348x-qwv2. For more information see the GitHub-hosted security advisory...
RUSTSEC-2022-0043 Improper validation of Windows paths could lead to directory traversal attack
towerhttp::services::fs::ServeDir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem. This only...
RUSTSEC-2021-0152 `out_reference::Out::from_raw` should be `unsafe`
Out::fromraw in affected versions allows writing a value to invalid memory address without requiring unsafe. The soundness issue has been addressed by making Out::fromraw an unsafe function...
RUSTSEC-2026-0319 anymap2 is unmaintained
The anymap2 crate is not maintained. anymap3 is the recommended replacement...
RUSTSEC-2026-0324 Guest can panic host through filesystem timestamp before the epoch on wasip3
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0321 WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0302 `stack-graphs` C API exports are safe `extern "C"` functions
stackgraphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them. sgstackgraphfree frees the pointer with Box::fromraw. sgstackgraphfreestd::ptr::nullmut is immediate...
RUSTSEC-2026-0301 Double free in `StackVec::retain` when a predicate or element `Drop` panics
Summary StackVec::retain committed its new length to self.len only after its internal loop completed. If the retain predicate or a removed element's Drop implementation panicked before the loop finished, unwinding proceeded with self.len still equal to the original, pre-retain length, leaving...
RUSTSEC-2026-0296 `unzip` is unmaintained
The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...
RUSTSEC-2026-0304 Finished streaming calls keep reading a stalled request body indefinitely
Affected versions of connectrpc start a background task to read the request body of every client-streaming and bidirectional-streaming call, before the interceptors or the handler run. A call can finish before it has consumed its request: the handler can return without reading all of its request...
RUSTSEC-2026-0287 cosmian_kyber is unmaintained
cosmiankyber is a fork of Argyle-Software/kyber that has seen no maintainer activity. It inherits the fork parent's broken AVX2 constant-time code, and the open fix pull request Cosmian/kyber6 has gone unanswered. Recommended alternatives: - aws-lc-rs - graviola...
RUSTSEC-2026-0297 `unzip`: archive extraction is vulnerable to path traversal (zip-slip)
Summary Unzipper::unzip extracts each archive entry to a path built from the entry's raw, attacker-controlled name without any traversal check. A ZIP archive whose entry names contain ../ components or an absolute path can therefore cause files to be written outside the destination directory chos...
RUSTSEC-2026-0292 Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
Chunk::clear, dropleft, dropright and InlineArray::clear, truncate drop the removed elements before updating the metadata that records which slots hold live values — the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update is...
RUSTSEC-2026-0064 `tokio-udp` is unmaintained
The tokio-udp crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0058 `tokio-io` is unmaintained
The tokio-io crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0020 Guest-controlled resource exhaustion in WASI implementations
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-852m-cvvp-9p4w For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0016 `polymarkets-rs-clob-client` was removed from crates.io for malicious code
This is part of an ongoing campaign to attempt to typosquat crates in the polymarket-client-sdk ecosystem to exfiltrate user credentials. The malicious crate had 1 version published on 2026-02-19 approximately 20 hours before removal and had no evidence of actual downloads. There were no crates...
RUSTSEC-2026-0005 Potential use-after-free in `oneshot` when used asynchronously
There is a race condition that can lead to a use-after-free if a oneshot::Receiver is polled but then dropped instead of polled to completion. This could happen if the receiver future was cancelled while receiving, for example by being wrapped in a timeout future or similar. When the Receiver is...
RUSTSEC-2025-0137 Unsoundness of safe `reciprocal_mg10`
The function reciprocalmg10 is marked as safe but can trigger undefined behavior out-of-bounds access because it relies on debugassert! for safety checks instead of assert!. When compiled in release mode, the debugassert! is optimized out, potentially allowing invalid inputs to cause memory...