1310 matches found
RUSTSEC-2026-0356 Panic on erroneous call-to-host from guest realloc call
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0357 Out-of-bounds zero-length stream writes can panic
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0354 Host panic when component `call_async` is cancelled under some conditions
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0352 Filesystem sandbox escape when renaming symlinks with trailing slashes
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0358 Yielding in a component start function can lead to a host panic
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0355 Panic viewing component model stream or future as the wrong type
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0347 Buffered application data sent to outer server after ECH rejection
When a server rejects Encrypted Client Hello ECH, the client completes the handshake using the outer ClientHello and authenticates the server against the ECH config's publicname. At the end of that handshake, rustls encrypted and queued any application data buffered via ClientConnection::writer...
RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0360 Overlapping string transcode in a fused adapter can panic
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0348 Brotli certificate decompression can allocate up to 1 GiB before authentication
The built-in Brotli certificate decompressor enabled by the non-default brotli crate feature bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can...
RUSTSEC-2026-0351 `wasi-http`: Request with long url before query parameter crashes host
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0362 Wasmtime may not properly enforce async-entrypoint requirement
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0359 Stack overflow dropping a long chain of recursive types
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0353 Panic when invoking an async-lifted function via `call`
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0361 Panic when pending calls are run after a trap
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0349 Unauthenticated ServerHello can downgrade later connections to classical key exchange
The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name. A network attacker can answer one connection...
RUSTSEC-2026-0350 Guests can send absolute-form HTTP requests to different hosts
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0346 `Debug` impls for client session values expose TLS secrets
The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output. Custom ClientSessionStore implementations that format these values with Debug for example, when logging could disclos...
RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...
RUSTSEC-2026-0337 Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
Poly1305 in ic-cipher absorbs messages of 64 bytes or more four blocks at a time, summing four products before one reduction. From 0.2.5 to 0.2.19 the reduction kept its carries in 32-bit integers, which four summed products can overflow when the message's bytes are large. This affects Poly1305 a...
RUSTSEC-2026-0335 Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
mykey implements MIKEY RFC 3830 for SRTP key exchange. Pre-shared key mode transmitted the TEK Generation Key TGK in the clear. MikeyMessage::newpskinit built its KEMAC payload with EncAlg::Null and placed the TGK in encdata verbatim. Anyone able to read a PSK-Init message therefore recovers the...
RUSTSEC-2026-0336 MIKEY message MAC is never verified on receive, so forged messages are accepted
mykey implements MIKEY RFC 3830 for SRTP key exchange. No receive path verified the MIKEY message authentication code. crypto::verifymac existed and was correct, but it was called only from unit tests — neither MikeyMessage::frombytes nor MikeyMessage::completepsk invoked it. newpskinit computed ...
RUSTSEC-2026-0333 Resource budgets not enforced on the typed deserialization path
ParserConfig::maxevents, maxnodes, maxtotalscalarbytes, maxmergekeys, aliasanchorratio and the alias jump factor were enforced only by the two Value loaders. A typed target with a default-shaped configuration is served by the streaming deserializer, which never read those fields, so tightening an...
RUSTSEC-2026-0325 Mis-typed WebAssembly tag imports can lead to GC heap corruption
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-cfhf-m2cr-62wj For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0323 fd_readdir copies uninitialized struct padding into guest memory
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-96f6-r43r-8c24 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0327 Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-32h6-97mm-8q3c For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0324 Guest can panic host through filesystem timestamp before the epoch on wasip3
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mr2v-56j5-cmfc For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0320 Wasmtime wasi:http implementation panics with a zero timeout supplied
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w4qr-p94g-mjhv For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0319 anymap2 is unmaintained
The anymap2 crate is not maintained. anymap3 is the recommended replacement...
RUSTSEC-2026-0321 WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j366-h8gg-77pm For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0322 Excessive allocated memory on the host when guests don't have stdio
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-gqmc-89g8-p25r For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0326 Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hw8m-q44c-ggrf For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0317 A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches...
RUSTSEC-2026-0318 Sending custom to-device messages may panics
Using the IdentityBasedStrategy setting when calling Device::encrypteventraw or OlmMachine::encryptcontentfordevices may cause a panic if the recipient does not have cross-signing keys...
RUSTSEC-2026-0330 Hybrid Encapsulation from Seed Panics on Short Seed
For a hybrid KEM public key of type PublicKey::WingKemDraft06 or PublicKey::X25519MlKem768Draft06, the PublicKey::encapsulatederand function would panic in an indexing operation on a seed input of length shorter than 32 bytes. Impact Applications encapsulating with an attacker controlled seed val...
RUSTSEC-2026-0311 Stack overflow on deeply nested LaTeX input
The parser and layout engine in affected versions of latex-rust recurse once per level of nesting with no limit. Deeply nested input, such as \frac1…, braces, \sqrt…, \left, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the...
RUSTSEC-2026-0310 Various panics, soundness and resource exhaustion issues
Version 0.12.3 fixes a large number of panics, soundness issues, and CPU and memory exhaustion issues in all parts of the crate. The following is a summary of the issues per affected components. For details, please see the release notes. Base Limited the number of compression pointers that are...
RUSTSEC-2026-0315 `call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m63x-6p34-q65x For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0312 Excluded iPAddress name constraints with an all-zero mask are not applied
An excludedsubtrees iPAddress name constraint with an all-zero mask 0.0.0.0/0 or ::/0 does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a /0 prefix matches every address of its family, so the exclusion was silentl...
RUSTSEC-2026-0316 Dynamic record lifting can allocate beyond the hostcall fuel limit
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jqpg-j7w6-42pr For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0314 Guest can panic host through filesystem datetime overflow
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-j2g9-4prp-pf6h For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0308 Use-after-free in interned values and cached function results
When an application reads an interned value's fields or uses that value as an input to a tracked function, Salsa must ensure that reusable storage has been validated for the current database revision. This prevents the value's fields and associated cached function results from being freed while i...
RUSTSEC-2026-0313 Outgoing HTTP body write allows guest-driven host memory exhaustion
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0307 `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...
RUSTSEC-2026-0305 Use-after-free when XML includes have duplicated entities
Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...
RUSTSEC-2026-0303 `stack-graphs` is archived and unmaintained
The upstream repository github/stack-graphs has been archived. Issues and pull requests are disabled, so maintainers cannot be reached there. The last crates.io release is 0.14.1 2024-12-13. The repository's last push was 2025-09-09. There is no published successor...
RUSTSEC-2026-0301 Double free in `StackVec::retain` when a predicate or element `Drop` panics
Summary StackVec::retain committed its new length to self.len only after its internal loop completed. If the retain predicate or a removed element's Drop implementation panicked before the loop finished, unwinding proceeded with self.len still equal to the original, pre-retain length, leaving...
RUSTSEC-2026-0302 `stack-graphs` C API exports are safe `extern "C"` functions
stackgraphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them. sgstackgraphfree frees the pointer with Box::fromraw. sgstackgraphfreestd::ptr::nullmut is immediate...