1310 matches found
RUSTSEC-2026-0122 Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
InlineVec::clear and SerVec::clear in rkyv were not panic-safe. Both functions iterate over their elements and call dropinplace on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value. A subsequent invocati...
RUSTSEC-2026-0207 Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze an output using multiple calls to squeeze, rather than squeezing the full output at once, could output incorrect values. Internally, output blocks that were not completely squeezed were not buffered for th...
RUSTSEC-2026-0106 Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation
The Hickory DNS project's experimental hickory-recursor crate's record cache DnsLru stores records from DNS responses keyed by each record's own name, type, not by the query that triggered the response. cacheresponse in crates/recursor/src/lib.rs chains ANSWER, AUTHORITY, and ADDITIONAL sections...
RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsing
A panic was reachable when parsing certificate revocation lists via BorrowedCertRevocationList::fromder or OwnedCertRevocationList::fromder. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL...
RUSTSEC-2026-0107 `mysten-metrics` was removed from crates.io for malicious code
mysten-metrics included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io...
RUSTSEC-2026-0109 Broken hard revocation handling
Before sq-git checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy is expensive and a project's policy rarely changes, sq-git has an optimization to only check a policy if it hasn't checked it before. It does this by maintaining a set of policies...
RUSTSEC-2026-0098 Name constraints for URI names were incorrectly accepted
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. Since name constraints are restrictions on otherwis...
RUSTSEC-2026-0103 Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
A Double Free / Use-After-Free UAF vulnerability has been identified in the IntoIter::drop and ThinVec::clear implementations of the thin-vec crate. Both vulnerabilities share the same root cause and can trigger memory corruption using only safe Rust code - no unsafe blocks required. Undefined...
RUSTSEC-2026-0105 core2 is unmaintained, all versions yanked
The maintainer decided stop maintaining crate and yanked all published versions. Potential alternatives: - embedded-io solves the same general problem - no-std-io2 is a maintained fork...
RUSTSEC-2026-0099 Name constraints were accepted for certificates asserting a wildcard name
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, .example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very simila...
RUSTSEC-2026-0100 `pretty-changelog-logger` was removed from crates.io for malicious code
pretty-changelog-logger contains a build script build.rs that acts as a loader/dropper for malicious payloads. The malicious crate had 3 versions published on 2026-04-08 that had a total of 2239 downloads. There were no crates depending on this crate on crates.io. Thanks to Socket.dev for detecti...
RUSTSEC-2026-0101 `safe-agent-rs` was removed from crates.io for being affiliated with malicious code
While safe-agent-rs did not directly contain malicious code, it was owned by the same user as pretty-changelog-logger and microsoftsystem64. safe-agent-rs also appeared to be imitating a different websocket library. We decided to remove it out of an abundance of caution. This crate had 2 versions...
RUSTSEC-2026-0102 `microsoftsystem64` was removed from crates.io for malicious code
microsoftsystem64 installs a hardcoded SSH authorizedkeys entry persistence/backdoor and scans for sensitive files .env, credential-like JSON names, keyword-matching docs, reads their contents, base64-encodes where needed, and exfiltrates everything to a remote server via HTTP. It also packages a...
RUSTSEC-2026-0088 Data leakage between pooling allocator instances
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-6wgr-89rj-399p For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0095 Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-xx5w-cvp6-jv83 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0086 Host data leakage with 64-bit tables and Winch
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9w2-8782-2946 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0089 Host panic when Winch compiler executes `table.fill`
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q49f-xg75-m9xw For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0096 Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jhxm-h53p-jm7w For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0093 Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hx6p-xpx3-jvvv For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0097 Rand is unsound with a custom logger using `rand::rng()`
It has been reported by @lopopolo that the rand library is unsound i.e. that safe code using the public API can cause Undefined Behaviour when all the following conditions are met: - The log and threadrng features are enabled - A custom logger is defined - The custom logger accesses rand::rng...
RUSTSEC-2026-0084 `logprinter` was removed from crates.io for malicious code
The crate downloaded code from an external HTTP endpoint and executed it within its trace fn...
RUSTSEC-2026-0092 Panic when transcoding misaligned component model UTF-16 strings
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-jxhv-7h78-9775 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0090 Use-after-free bug after cloning `wasmtime::Linker`
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hfr4-7c6c-48w2 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0094 Improperly masked return value from `table.grow` with Winch compiler backend
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-f984-pcp8-v2p7 For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0085 Panic when lifting `flags` component value
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m758-wjhj-p3jq For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0087 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-qqfj-4vcm-26hv For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0091 Out-of-bounds write or crash when transcoding component model strings
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-394w-hwhg-8vgm For more information see the GitHub-hosted security advisory...
RUSTSEC-2026-0083 zantetsu-trainer is unmaintained
The zantetsu-trainer crate is no longer maintained. The ML training infrastructure it contained was removed as part of the zantetsu 0.2 release, which replaced the neural parser with a pure heuristic engine. A tombstone version 0.2.0 has been published and 0.1.4 has been yanked. There is no...
RUSTSEC-2026-0273 Stubbed cryptography without warnings
The manzana crate appears to be a work-in-progress module for the Apple Silicon chips' features, including the Secure Enclave. This crate's description and READMEs make no hint at the fact that the SecureEnclaveSigner type is a stubbed implementation that does not actually perform any cryptograph...
RUSTSEC-2026-0082 zantetsu-ffi is unmaintained
The zantetsu-ffi crate is no longer maintained. The Node.js, Python, and C FFI bindings it provided were removed as part of the zantetsu 0.2 release, which refocused the project on its core Rust library. A tombstone version 0.2.0 has been published and 0.1.4 has been yanked. There is no replaceme...
RUSTSEC-2026-0081 `logtrace` was removed from crates.io for malicious code
logtrace appeared to be downloading a RAT. The malicious crate had 2 versions published on 2026-04-01 that had a total of 30 downloads. There were no crates depending on this crate on crates.io. Thanks to Socket.dev for detecting and reporting this to the crates.io team!...
RUSTSEC-2026-0078 Symbol confusion after hasher panic in `intaglio` interners
Affected versions of this crate can leave all SymbolTable variants in an internally inconsistent state if a custom BuildHasher panics during HashMap::insert and the caller recovers with catchunwind. The intern implementations committed a vec.push... before the matching map.insert... completed. If...
RUSTSEC-2026-0124 Potential Panic on Overlong Ciphertext Buffer
An application that passes in a ciphertext buffer of length greater than ptxt.len + TAGLEN to libcruxchacha20poly1305::encrypt or libcruxchacha20poly1305::xchacha20poly1305::encrypt would experience a panic. Impact An application where the length of the ciphertext buffer is under attacker control...
RUSTSEC-2026-0064 `tokio-udp` is unmaintained
The tokio-udp crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0052 `tokio-sync` is unmaintained
The tokio-sync crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0063 `tokio-executor` is unmaintained
The tokio-executor crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0053 `tokio-tls` is unmaintained
The tokio-tls crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0051 `tokio-threadpool` is unmaintained
The tokio-threadpool crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0065 `tokio-signal` is unmaintained
The tokio-signal crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0062 `tokio-compat` is unmaintained
The tokio-compat crate is unmaintained. It was part of the transition from Tokio 0.1 to 0.2...
RUSTSEC-2026-0056 `tokio-codec` is unmaintained
The tokio-codec crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the tokio-util crate...
RUSTSEC-2026-0059 `tokio-tcp` is unmaintained
The tokio-tcp crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0060 `tokio-timer` is unmaintained
The tokio-timer crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0057 `tokio-reactor` is unmaintained
The tokio-reactor crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0055 `tokio-process` is unmaintained
The tokio-process crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0050 `tokio-uds` is unmaintained
The tokio-uds crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...
RUSTSEC-2026-0049 CRLs not considered authoritative by Distribution Point due to faulty matching logic
If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored. The impact was that correctly provided CRLs wou...
RUSTSEC-2026-0061 `tokio-fs` is unmaintained
The tokio-fs crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...