1310 matches found
RUSTSEC-2025-0057 fxhash - no longer maintained
The fxhash crate is no longer maintained. The repository is stale and owner is no longer active on GitHub. Please take a look at rustc-hash instead...
RUSTSEC-2025-0172 `zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...
RUSTSEC-2025-0033 Public API without sufficient bounds checking
Match::get and Match::ptr lack sufficient bounds checks, leading to potential out of bounds reads...
RUSTSEC-2025-0018 Potential out-of-bounds read with a malformed ELF file and the HashTable API.
Affected versions of this crate only validated the index argument of HashTable::getbucket and HashTable::getchain against the input-controlled bucketcount and chaincount fields, but not against the size of the ELF section. As a result, a malformed ELF file could trigger out-of-bounds reads in a...
RUSTSEC-2025-0011 `openpgp-card-sequoia` is unmaintained.
The openpgp-card-sequoia crate is no longer actively maintained. You can use the openpgp-card-rpgp crate for OpenPGP card client functionality instead...
RUSTSEC-2025-0028 cve-rs introduces memory vulnerabilities in safe Rust
This crate is a joke and should never be used. cve-rs provides demonstrations of common memory vulnerabilities such as buffer overflows and segfaults implemented completely within safe Rust. Internally, this crate does not use unsafe code, it instead exploits a soundness bug in rustc:...
RUSTSEC-2024-0408 Unsound usages of `std::slice::from_raw_parts`
The library breaks the safety assumptions when using unsafe API std::slice::fromrawparts. First, when using the API in iterator implementation TempFdArrayIterator.next, generic type could be any type, which would create and pass a misaligned pointer to the unsafe API. Second, when validating the...
RUSTSEC-2024-0380 Replaced by `pqcrypto-mldsa`
This crate has been replaced by pqcrypto-mldsa, which provides a FIPS204-compatible implementation of ML-DSA...
RUSTSEC-2024-0436 paste - no longer maintained
The creator of the crate paste has stated in the README.md that this project is not longer maintained as well as archived the repository Possible Alternatives - pastey: a fork of paste and is aimed to be a drop-in replacement with additional features for paste crate - withbuiltinmacros: crate...
RUSTSEC-2024-0383 bcc is unmaintained
bcc will no longer be maintained as declared by the developer. Users are recommended to use libbpf-rs instead. See libbpf-rs...
RUSTSEC-2024-0386 strason is unmaintained
strason will no longer be maintained as declared by the developer. The project has been archived...
RUSTSEC-2024-0403 op_panic in the base runtime can force a panic in the runtime's containing thread
Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic...
RUSTSEC-2024-0414 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2024-0415 gtk-rs GTK3 bindings - no longer maintained
The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at gtk4-rs instead. Update The gtk-rs repository was unarchived and the README...
RUSTSEC-2023-0112 `monero-rpc-rs` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...
RUSTSEC-2023-0114 `tiny-server` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...
RUSTSEC-2023-0033 Parsing borsh messages with ZST which are not-copy/clone is unsound
Affected versions of borsh cause undefined behavior when zero-sized-types ZST are parsed and the Copy/Clone traits are not implemented/derived. For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy this can be achieved through a singleton, then accessing/writing to...
RUSTSEC-2023-0050 multipart is Unmaintained
The multipart crate is unmaintained. The author has archived the github repository. Alternatives: - multer - multiparty...
RUSTSEC-2023-0036 tree_magic is Unmaintained
The treemagic crate is unmaintained. The author has archived the github repository. Alternatives: - treemagicmini...
RUSTSEC-2023-0021 NULL pointer dereference in `stb_image`
A bug in error handling in the stbimage C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file. This is fixed in version 0.2.5 and later of the stbimage Rust crate, by patching the C code to correctly handle NULL pointers. Thank you to GitHub...
RUSTSEC-2022-0062 matrix-sdk 0.6.0 logs access tokens
When sending Matrix requests using an affected version of matrix-sdk in an application that writes logs using tracing-subscriber in a way that includes fields of tracing spans such as tracingsubscribers default text output from the fmt module, these logs will contain the user's access token...
RUSTSEC-2022-0012 Arrow2 allows double free in `safe` code
The struct FfiArrowArray implements deriveClone that is inconsistent with its custom implementation of Drop, resulting in a double free when cloned. Cloning this struct in safe results in a segmentation fault, which is unsound. This derive was removed from this struct. All users are advised to...
RUSTSEC-2021-0149 nphysics2d is unmaintained
The maintainer has advised that this crate is passively-maintained and that it is being superseded by the Rapier project...
RUSTSEC-2021-0151 ncollide2d is unmaintained
The maintainer has advised that this crate is passively-maintained and that it is being superseded by the Parry project...
RUSTSEC-2021-0003 Buffer overflow in SmallVec::insert_many
A bug in the SmallVec::insertmany method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap. This bug was only triggered if the iterator passed to insertmany yielded more items than the...
RUSTSEC-2020-0066 crate has been renamed to `sn_bindgen`
This crate has been renamed from safebindgen to snbindgen. The new repository location is:...
RUSTSEC-2026-0362 Wasmtime may not properly enforce async-entrypoint requirement
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0363 Component-model handle tables are capped only per instance and charged to no limit
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0364 Exception tags can cause host data structures to be unaligned
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0356 Panic on erroneous call-to-host from guest realloc call
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0348 Brotli certificate decompression can allocate up to 1 GiB before authentication
The built-in Brotli certificate decompressor enabled by the non-default brotli crate feature bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can...
RUSTSEC-2026-0352 Filesystem sandbox escape when renaming symlinks with trailing slashes
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0344 Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it. The compressed size of a block was capped...
RUSTSEC-2026-0309 `SinglyLinkedList::remove` dereferences a null link
In versions before 0.2.1, SinglyLinkedList::remove is safe and walks the intrusive list with an unchecked dereference. On an empty list, or when node is not in the list, currentelm.next reads a null pointer. That is undefined behavior. The list head is a raw mut Node, and safe code can construct...
RUSTSEC-2026-0294 Unsoundness in UTF-8 'String' trait
The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust...
RUSTSEC-2026-0289 pqc_kyber is unmaintained
The crate has had no releases since 0.7.1 2023-08-23, and the upstream repository shows no maintainer activity. Open pull requests, including a fix for a chosen-ciphertext key-recovery flaw in the AVX2 backend Argyle-Software/kyber121, have gone unanswered. Recommended alternatives: - aws-lc-rs -...
RUSTSEC-2026-0340 Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
When sending ACKFREQUENCY frames is enabled through TransportConfig::ackfrequencyconfigSome.., the peer's transport parameters could cause AckFrequencyState::candidatemaxackdelay to call Duration::clamp with a minimum greater than its maximum, which panics. For example, a peer advertising a...
RUSTSEC-2026-0295 Memory corruption bug on `ApplyResult` type
The ApplyResult type contains a raw pointer to a C++ memory object and has a derived Clone implementation which creates a reference to this object without incrementing the associated reference counter. As a result, if an instance of ApplyResult is duplicated through Clone and both instances are...
RUSTSEC-2026-0096 Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0057 `tokio-reactor` is unmaintained
The tokio-reactor crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0064 `tokio-udp` is unmaintained
The tokio-udp crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0058 `tokio-io` is unmaintained
The tokio-io crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0003 Non-constant-time code generation on ARM32 targets
Summary While the cmov crate has a special backend for aarch64 which uses special CSEL instructions, on 32-bit ARM it uses a portable pure Rust fallback implementation. This implementation uses a combination of bitwise arithmetic and core::hint::blackbox to attempt to coerce constant-time code...
RUSTSEC-2025-0140 Non-utf8 String can be created with `TimeBuf::as_str`
The function gixdate::parse::TimeBuf::asstr can create an illegal string containing non-utf8 characters. This violates the safety invariant of TimeBuf and can lead to undefined behavior when consuming the string. The bug can be prevented by adding str::fromutf8 to the function TimeBuf::write...
RUSTSEC-2025-0146 `sha-rust` was removed from crates.io for malicious code
It appeared to be attempting to steal credentials from local files...
RUSTSEC-2025-0119 number_prefix crate is unmaintained
The numberprefix crate is no longer actively maintained. If you rely on this crate, consider switching to a recommended alternative. Recommended alternatives - unit-prefix...
RUSTSEC-2025-0136 Underflow in aes_key_unwrap function
The aeskeyunwrap function would panic if passed a ciphertext that was too short. In a debug build, it would panic due to a subtraction underflow. In a release build, it would use the small negative quantity to allocate a vector. Since the allocator expects an unsigned quantity, the negative value...
RUSTSEC-2025-0108 Uninitialized memory exposure in string reading functions
Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found. This allows reading uninitialized memory which may contain sensitive data from previous allocations. The ncurses-rs repository is archived and unmaintained...
RUSTSEC-2025-0075 `unic-char-range` is unmaintained
All Unicode crates that are part of https://github.com/open-i18n/rust-unic are unmaintained. Recommended alternatives - Since version 1.45.0 Rust supports using char with ops::Range, RangeFrom, RangeFull, RangeInclusive, RangeTo to iterate over a range of codepoints...