`verify_x509_cert` does not check the certificate validity period

tdxworkloadattestation::verification::x509::verifyx509cert, available with the host-verification feature, checked that issuercert issued cert and verified the certificate signature. It did not check the certificate's validity period, so it accepted expired and not-yet-valid certificates. With the...

Panic on a GCP launch endorsement without TDX measurements

GcpTdxHost::verifylaunchendorsement, available with the host-gcp-tdx feature, read uefigolden.tdx.measurements0 without checking that the golden measurement contains a TDX measurement. If a launch endorsement's golden measurement had no TDX measurements, the call panicked with an index out of...

`electrumd` was removed from crates.io for malicious code

electrumd attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 5 versions published on 2026-01-26, approximately 10 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

`env-test-guard` was removed from crates.io for malicious code

env-test-guard attempted to exfiltrate credentials from the environment to an arbitrary URL. The malicious crate had 2 versions published on 2026-03-24 and 2026-03-25, approximately 8 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks t...

`gabby-types-sec` was removed from crates.io for malicious code

gabby-types-sec attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-17, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for th...

`webhook_commands` was removed from crates.io for malicious code

webhookcommands attempted to send telemetry from the execution environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-13, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison fo...

`shinchina-test` was removed from crates.io for malicious code

shinchina-test attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-02, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for th...

`shinchina` was removed from crates.io for malicious code

shinchina attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

Request smuggling through malformed chunked request trailers

The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request. When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the chunked stream, the decoder can consu...

Memory exhaustion when parsing a crafted `iloc` box

heifer-isobmff read the item and extent counts of the iloc box item locations from the file and allocated memory for them before checking that the box was large enough to hold that many entries. Extents that declare no field at all take zero bytes each, so a small crafted file could declare an...

Panic on chroma QP offsets enabled with an empty offset list

An HEVC Range Extensions stream can set cuchromaqpoffsetenabledflag in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole...

Out-of-bounds read when decoding internal keys shorter than 16 bytes

InternalKeyRef::fromencoded is a safe constructor whose only length check is debugassert!encoded.len = 16, which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: userkey slices &encoded..len - 16, trailer/seqnum pass len - 16 and timestamp passes...

Rejected authentication challenges can poison the Key Vault scope cache

Affected versions of KeyVaultAuthorizer::onchallenge cache the authentication scope from a WWW-Authenticate response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains cached. A subsequent request through the sam...

`sec-gemini` was removed from crates.io for malicious code

sec-gemini attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 versions published on 2025-06-19, approximately 17 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

Unbounded response body buffering in Streamable HTTP clients

Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming HTTP response bodies into memory with no size limit. Both the reqwest client transport-streamable-http-client-reqwest and the Unix socket client transport-streamable-http-client-unix-socket were affected: -...

Panic on an HEVC tile layout that does not match the active SPS

An HEVC picture parameter set PPS stores explicit tile column widths and row heights computed against the sequence parameter set SPS active when it was parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes add up to more than the picture. The decoder then indexed past...

xattr functions mark unwritten bytes as initialized when given a zero-length buffer

The extended-attribute functions in rustix::fs getxattr, lgetxattr, fgetxattr, listxattr, llistxattr and flistxattr write into a Buffer and then mark as many bytes initialized as the system call reported. When the buffer has zero length, the operating system treats the call as a size query: it...

Rejected authentication challenges can poison the Key Vault scope cache

Affected versions of KeyVaultAuthorizer::onchallenge cache the authentication scope from a WWW-Authenticate response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains cached. A subsequent request through the sam...

`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`

tdxguest::tdcall::enterl2vcpu invokes the TDG.VP.ENTER TDCALL. RCX must carry the L2 VM index in bits 53:52 and the invalidation control value InvdTranslations, 0 to 3 in bits 1:0. The function computed that value as l2vmidx 52 | invdtranslations as u64, but then passed the raw l2vmidx in RCX...

Transaction::from_json holds an input txid that is not 64 hex digits and writes the input as spending the zero txid

Transaction::fromjson, for a document with no hex member, held each input's txid member as given. An input txid that is not 64 hex digits "zz", "", 63 or 65 digits, characters that are not hex digits answered Ok: sourcetxid and tojson gave the text back, while tobinary wrote the input as spending...

Signature::from_der reads a signature with bytes after it, a wrong sequence length or an unneeded zero as the signature

Signature::fromder read a DER-encoded ECDSA signature leniently. It read as the signature: the signature followed by other bytes; a sequence length shorter than its contents, or longer with bytes after them a length byte with its high bit set among them; and an R or S preceded by a zero byte it d...

BEEF validation answers valid for a raw entry that is not a transaction

Beef::mergerawtx and BeefTx::fromrawtx accept raw bytes without a Result. For bytes that are not exactly one transaction a transaction followed by bytes, a cut transaction, bytes that are no transaction at all, Beef::sorttxs, verifystructure, verifyvalid and isvalid could answer valid, even with ...

Transaction readers accept trailing bytes, so a parsed transaction can carry another transaction id

Transaction::frombinary and Transaction::fromhex read one transaction from the front of their input, did not check that the input ended there, and kept the whole input as the transaction's cached serialization: tobinary, tohex and id then answered for bytes that are not the transaction's...

Agent server signs with confirm-constrained keys without calling `Agent::confirm`

A key added to an SSH agent with the confirm constraint what ssh-add -c sends must not be used to sign until the user approves each use. russh's agent server russh::keys::agent::server accepted the constraint, but when a sign request arrived for such a key it used a fixed true in place of the...

OAuth client SSRF filter checks host strings, not resolved addresses

From 2.0.0 until 3.7.0, the rmcp OAuth client decided whether it may fetch an authorization server's metadata URL by inspecting only the host string. It rejected literal loopback, private and link-local IP addresses and known cloud metadata hostnames, but it did not resolve other hostnames. A...

Unbounded tool schema cache in Streamable HTTP server transport

From 3.0.0 until 3.6.0, StreamableHttpService cached the result of ServerHandler::gettool in a process-wide map keyed by the tool name of incoming tools/call requests. The map had no size limit and no eviction, and it also cached unknown tool names. An entry was added while the request headers we...

`astral-tl` is unmaintained

Astral deprecated astral-tl on October 5, 2026. All versions of the crate are unmaintained. For HTML parsing, Astral recommends astral-html as a replacement. astral-html: https://crates.io/crates/astral-html...

`pin-utils` is unmaintained

The upstream repository was archived on October 1, 2026, after the release of version 0.1.1. For local pinning, replace pinmut! with core::pin::pin!, available since Rust 1.68. For pin projection, replace unsafepinned! and unsafeunpinned! with pin-project or pin-project-lite. upstream repository:...

Rejected authentication challenges can poison the Key Vault scope cache

Affected versions of KeyVaultAuthorizer::onchallenge cache the authentication scope from a WWW-Authenticate response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains cached. A subsequent request through the sam...

Paths or symlinks ending in a slash escape the sandbox

cap-primitives resolves a path inside a sandboxed directory one component at a time and opens the last component with ONOFOLLOW, so that a symlink there cannot lead out of the directory. When the path ended in /, the resolver added the slash back to the last component before opening it. With a...

Inverted bitmap validation in `invalidate_l2_cached_ept`

tdxguest::tdcall::invalidatel2cachedept takes a bitmap that selects the L2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3 select L2 VMs 1 through 3, and all other bits are reserved. The input check was inverted: if l2vmidxbitmap & !0b1110 == 0 return...

Out-of-bounds write in `aes::unwrap_key`

openssl::aes::unwrapkey guarded the size of its output buffer with an inverted assertion, out.len + 8 = in.len. Instead of rejecting an out buffer too small for the unwrapped key, it rejected buffers larger than needed and accepted buffers that were too small. When out is shorter than in.len - 8...

Panic when decoding malformed Ed25519 keys from Base64

In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::frombase64 and Ed25519SecretKey::frombase64 panic on malformed input instead of returning an error, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes. An attacker who can supply a key to an application using...

eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows

When extracting archives, eazip validates symlink entries before writing them. The validation function validatesymlink src/utils/mod.rs scans for backslash and NUL bytes, but passes the symlink's name where the symlink's target was intended: rust memchr2b'\', b'\0', name.asbytes // should be...

`top_level_crate` was removed from crates.io for malicious code

toplevelcrate attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

`sqlcipher-src` via C SQLite CVE-2026-119375

SQLite versions before 3.54.0 can return uninitialized page-cache memory when a process opens a database file together with a sibling write-ahead-log -wal file whose page size differs from the database's. A crafted pair of files can make ordinary queries return stale bytes from the process's...

Unbounded retries on truncated responses in the name server pool

When an upstream answer had the TC truncated bit set, the resolver's name server pool disabled UDP and sent the query again. It did this for every truncated answer, including answers that already came over TCP, and it kept no count of retries. A name server that sets TC on every answer, which...

`Resolver::lookup` and `lookup_ip` returned records that failed DNSSEC validation

With DNSSEC validation enabled, Resolver::lookup and Resolver::lookupip returned Ok with the records even when validation found the response bogus. The result was only visible in each record's proof status, which callers had to inspect themselves. Applications that enable validation and treat a...

Inverted NSEC3 comparison lets one record "prove" that almost any name does not exist

When DNSSEC validation looks for the NSEC3 record that covers a hashed name, the last record in the zone's hash chain needs special handling, because its next hashed owner name sorts before its own hash. For that record the two comparisons were reversed: it was treated as covering every hash belo...

Recursor followed every glueless name server in a referral (no fixed hickory-recursor release)

For referrals whose name servers are outside the delegated zone and come without glue, the recursor resolved every listed name server, with no cap on referral width and no per-query work budget. Someone who controls a zone can use this to make each client query send a large number of queries to a...

Spoofed malformed UDP datagrams abort DNS lookups

While waiting for a reply on a UDP connection, the client parsed every datagram that arrived from the name server's address and port before checking its message ID. If parsing failed, the attempt ended with an error instead of dropping the datagram and waiting for the real reply. The receive loop...

Recursor kept querying cyclic glueless sibling delegations

Two zones can each delegate to name servers named only inside the other zone, with no glue records the cyclic sibling case in RFC 9471 section 2.3. Such delegations can never be resolved, but the recursor did not stop when it came back to a zone it was already resolving. It kept sending queries...

NXDOMAIN accepted for an empty non-terminal that the NSEC record proves exists

When an NSEC record's next domain name is below the queried name, the queried name exists as an empty non-terminal RFC 8020 section 3.1. The NSEC validator did not check for this case and accepted an NXDOMAIN response backed by such a record as secure. The response code is not covered by any...

NXDOMAIN accepted for a proven empty non-terminal (hickory-proto)

Up to 0.26.0-alpha.1, hickory-proto's NSEC validation accepted an NXDOMAIN response as secure even when the covering NSEC record's next domain name was below the queried name, which proves the name exists as an empty non-terminal. Because the response code is not signed, someone who can modify DN...

DNSSEC validation accepted an unrelated signed RRset as the answer (hickory-proto)

Up to 0.26.0-alpha.1, hickory-proto's DNSSEC validation treated a response with a non-empty answer section as a positive answer if its records validated, without checking that any of them matched the queried name and type. Someone who can answer or modify DNS responses could return a genuine sign...

Zone file lexer panics on a token of 4096 or more characters

The zone file lexer read each token in a loop capped at 4,096 iterations, with an assert! on the loop counter as a safety bound. A single token long enough to reach that bound, for example a very long name or character string in a zone file, triggered the assertion and the parser panicked instead...

NSEC3 records from another zone were accepted in proofs of nonexistence

When DNSSEC validation used NSEC3 records to prove that a name or record type does not exist, it compared only the hashed first label of each NSEC3 owner name with the hash of the name being checked. The rest of the owner name, which says which zone the record belongs to, was not checked. Someone...

DNSSEC validation cache could reuse an Insecure result for a different name

The DNSSEC validation cache used a 64-bit hash of the query as its key, and two keys with the same hash counted as equal. The Hash implementation of Name hashed the bytes of the labels but not where one label ends and the next begins, so names that differ only in the placement of dots such as ab....

DNSSEC validation accepted a validly signed but unrelated RRset as the answer

When a response had a non-empty answer section, DNSSEC validation treated it as a positive answer as long as the records in it validated. It did not check that any of those records had the queried name and either the queried type or type CNAME. An attacker who can answer or modify DNS responses c...

Panic on a malformed `alpn` value when parsing SVCB or HTTPS records from text

When an SVCB or HTTPS record is parsed from its text zone file form, the alpn service parameter value is split into a list of protocol names. That step called expect on the result, on the assumption that it could not fail. A malformed value, such as one with an unbalanced quote alpn="h, two comma...