Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key

KeyShares::frombackupformat the Shamir backup share reader, public since 0.2.0, the crate's first release accepted a share whose x coordinate is 0, and KeyShares::recoverprivatekey interpolates the shares at x = 0 to recover the key. At an x of 0 the interpolation answers that share's y value...

Transaction::from_json holds an input txid that is not 64 hex digits and writes the input as spending the zero txid

Transaction::fromjson, for a document with no hex member, held each input's txid member as given. An input txid that is not 64 hex digits "zz", "", 63 or 65 digits, characters that are not hex digits answered Ok: sourcetxid and tojson gave the text back, while tobinary wrote the input as spending...

Panic when decoding malformed Ed25519 keys from Base64

In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::frombase64 and Ed25519SecretKey::frombase64 panic on malformed input instead of returning an error, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes. An attacker who can supply a key to an application using...

Signature::from_der reads a signature with bytes after it, a wrong sequence length or an unneeded zero as the signature

Signature::fromder read a DER-encoded ECDSA signature leniently. It read as the signature: the signature followed by other bytes; a sequence length shorter than its contents, or longer with bytes after them a length byte with its high bit set among them; and an R or S preceded by a zero byte it d...

`lwd-uri-util` was removed from crates.io for malicious code

The lwd-uri-util crate exfiltrated SSH keys, AWS credentials, and other environmental metadata and secrets when any crate using it was built. The malicious crate had 8 versions published on 2026-11-09 approximately 12 hours before removal and had no evidence of actual usage. This crate had no...

BEEF validation answers valid for a raw entry that is not a transaction

Beef::mergerawtx and BeefTx::fromrawtx accept raw bytes without a Result. For bytes that are not exactly one transaction a transaction followed by bytes, a cut transaction, bytes that are no transaction at all, Beef::sorttxs, verifystructure, verifyvalid and isvalid could answer valid, even with ...

`verify_x509_cert` does not check the certificate validity period

tdxworkloadattestation::verification::x509::verifyx509cert, available with the host-verification feature, checked that issuercert issued cert and verified the certificate signature. It did not check the certificate's validity period, so it accepted expired and not-yet-valid certificates. With the...

Panic on a GCP launch endorsement without TDX measurements

GcpTdxHost::verifylaunchendorsement, available with the host-gcp-tdx feature, read uefigolden.tdx.measurements0 without checking that the golden measurement contains a TDX measurement. If a launch endorsement's golden measurement had no TDX measurements, the call panicked with an index out of...

Transaction readers accept trailing bytes, so a parsed transaction can carry another transaction id

Transaction::frombinary and Transaction::fromhex read one transaction from the front of their input, did not check that the input ended there, and kept the whole input as the transaction's cached serialization: tobinary, tohex and id then answered for bytes that are not the transaction's...

`electrumd` was removed from crates.io for malicious code

electrumd attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 5 versions published on 2026-01-26, approximately 10 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

`env-test-guard` was removed from crates.io for malicious code

env-test-guard attempted to exfiltrate credentials from the environment to an arbitrary URL. The malicious crate had 2 versions published on 2026-03-24 and 2026-03-25, approximately 8 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks t...

`gabby-types-sec` was removed from crates.io for malicious code

gabby-types-sec attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-17, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for th...

`webhook_commands` was removed from crates.io for malicious code

webhookcommands attempted to send telemetry from the execution environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-13, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison fo...

eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windows

When extracting archives, eazip validates symlink entries before writing them. The validation function validatesymlink src/utils/mod.rs scans for backslash and NUL bytes, but passes the symlink's name where the symlink's target was intended: rust memchr2b'\', b'\0', name.asbytes // should be...

Degraded secret zeroization capabilities

In version 0.11.1 and earlier of vodozemac, the Olm root key ratchet did not zeroize its HKDF output after use. Each ratchet step left a copy of the new root key and chain key in freed heap memory. Impact An attacker who can read the process's memory, for example through a separate...

Large-window Brotli bodies bypass decompression memory limits

With the compress-brotli feature enabled, the decoder accepts the non-standard large-window Brotli format. A crafted stream can cause its internal buffer to grow to about 1 GiB before the decoded output reaches the configured size limit. An 850-byte request can cause this allocation, and concurre...

`shinchina-test` was removed from crates.io for malicious code

shinchina-test attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-02, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for th...

`top_level_crate` was removed from crates.io for malicious code

toplevelcrate attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

Unbounded decompression can exhaust memory and CPU resources

The encoding::Decoder stream can expand compressed input into a large output buffer before a caller can enforce its body size limit. An attacker who controls a compressed request or response can cause excessive memory allocation and CPU use, resulting in denial of service. This affects applicatio...

`shinchina` was removed from crates.io for malicious code

shinchina attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-01, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

Compressed request bodies can exhaust memory before extractor limits apply

Body extractors do not pass their size limits to the decompression layer. A small compressed request can therefore cause a large allocation before the extractor rejects the decoded body. A remote attacker can use this to exhaust memory or CPU resources and cause denial of service. This affects...

Request smuggling through malformed chunked request trailers

The HTTP/1 chunked decoder accepts a bare line feed after the final chunk as the start of a trailer instead of rejecting the malformed request. When an upstream proxy reuses a connection and either pipelines the requests or does not take steps to validate the chunked stream, the decoder can consu...

`build_dep` was removed from crates.io for malicious code

builddep attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2025-03-03, approximately 20 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the repo...

Hidden file disclosure through Windows short names

On Windows volumes with 8.3 short names, actixfiles::Files can serve hidden files through their short-name aliases. The default path check rejects segments that start with a dot, but an alias such as ENV1 or GIT1 passes this check. A remote client can read files such as .env or .git/config in the...

`sec-gemini` was removed from crates.io for malicious code

sec-gemini attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 versions published on 2025-06-19, approximately 17 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bitbison for the...

Degraded secret zeroization capabilities

Versions 0.11.0 and 0.11.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies chacha-20poly1305, sha2, hmac, which moved secret zeroization capabilities behind a feature flag while vodozemac disabled the default feature set. Impact...

`ocipkg` is unmaintained

The author of ocipkg has archived the repository and declared the crate no longer maintained. Version 0.4.1 is stated to be the final release. "No further updates, including security fixes, are planned." Alternatives - For interacting with OCI registries, the maintainer suggests the ORAS project'...

Unbounded response body buffering in Streamable HTTP clients

Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming HTTP response bodies into memory with no size limit. Both the reqwest client transport-streamable-http-client-reqwest and the Unix socket client transport-streamable-http-client-unix-socket were affected: -...

Memory exhaustion when parsing a crafted `iloc` box

heifer-isobmff read the item and extent counts of the iloc box item locations from the file and allocated memory for them before checking that the box was large enough to hold that many entries. Extents that declare no field at all take zero bytes each, so a small crafted file could declare an...

Panic on chroma QP offsets enabled with an empty offset list

An HEVC Range Extensions stream can set cuchromaqpoffsetenabledflag in a slice while its picture parameter set carries an empty chroma QP offset list. The decoder then read the list at the signalled index, which panicked on the out-of-range access. A panic aborts the decoding thread, or the whole...

Panic on an HEVC tile layout that does not match the active SPS

An HEVC picture parameter set PPS stores explicit tile column widths and row heights computed against the sequence parameter set SPS active when it was parsed. A crafted stream can redefine that SPS afterwards, so that the tile sizes add up to more than the picture. The decoder then indexed past...

Out-of-bounds read when decoding internal keys shorter than 16 bytes

InternalKeyRef::fromencoded is a safe constructor whose only length check is debugassert!encoded.len = 16, which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: userkey slices &encoded..len - 16, trailer/seqnum pass len - 16 and timestamp passes...

Data race and double free via unsound `Send`/`Sync` in `reblessive`

dbs::Executor drives every SurrealQL statement through reblessive::tree::TreeStack. In reblessive 0.4.3 the runtime types unconditionally assert Send/Sync unsafe impl Send/Sync for Stack, TreeStack and Runner, while the public entry points accept any future without a Send bound and store it...

`astral-tokio-tar` is unmaintained

Astral ended maintenance of astral-tokio-tar on November 3, 2026. All versions of the crate are deprecated and unmaintained. For strict tar encoding and decoding, Astral recommends tar-codec as a possible replacement. 0.7.1 release: https://github.com/astral-sh/tokio-tar/releases/tag/v0.7.1...

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Improper validation of RunEndEncoded arrays via ArrayData::validatevalues can allow reading data beyond the bounds of the child values array when reading the last value via APIs such as TypedRunArray::value. Patched versions now properly validate the contents of RunEndEncoded arrays to prevent...

Unbounded memory allocation in `thrift` binary protocol `read_bytes`

Affected versions of the thrift crate size a buffer directly from an attacker-controlled 4-byte length read off the wire, before reading any payload and with no upper bound, allowing a hostile peer to force a large eager allocation or an immediate abort denial of service, CWE-400 / CWE-789. This ...

Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)

The Kitty graphics protocol handler in rio-vt builds a filesystem path from an attacker-controlled APC escape sequence and, for the temp-file medium, only checks that the path contains the substring "tty-graphics-protocol" before it opens, reads, and removefiles it. There is no .. rejection and n...

Unbounded memory allocation in `evtx` parsing a `.wevtcache` file

Affected versions of evtx did not bound a per-entry payload length read from a .wevtcache file before allocating a buffer sized from it, allowing a tiny crafted file to force a multi-gigabyte allocation and abort the process out-of-memory denial of service, CWE-400. Details In...

`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)

codeq is a serialization library whose Decode trait reads length-prefixed values. For String and Vec, the length-prefixed Decode implementations read a 4-byte big-endian length and allocate a buffer of that size before reading the payload. Because the declared length is taken straight from the...

`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

ant-releases downloads and unpacks release archives from the safenetwork / autonomi repositories. When it extracts an archive, it builds each output path by joining the archive entry's own name onto the destination directory, with no check for .. or absolute components — a classic "zip-slip" path...

Agent server signs with confirm-constrained keys without calling `Agent::confirm`

A key added to an SSH agent with the confirm constraint what ssh-add -c sends must not be used to sign until the user approves each use. russh's agent server russh::keys::agent::server accepted the constraint, but when a sign request arrived for such a key it used a fixed true in place of the...

`sqlcipher-src` via C SQLite CVE-2026-119375

SQLite versions before 3.54.0 can return uninitialized page-cache memory when a process opens a database file together with a sibling write-ahead-log -wal file whose page size differs from the database's. A crafted pair of files can make ordinary queries return stale bytes from the process's...

`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)

When ocipkg unpacks an OCI archive, the destination directory is derived from the image name, which ocipkg reads from the archive's own index.json org.opencontainers.image.ref.name. That name is attacker-controlled, and ImageName::parse accepts a hostname of .., so the computed destination escape...

`libsqlite3-sys` via C SQLite CVE-2026-119375

SQLite versions before 3.54.0 can return uninitialized page-cache memory when a process opens a database file together with a sibling write-ahead-log -wal file whose page size differs from the database's. A crafted pair of files can make ordinary queries return stale bytes from the process's...

LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

Summary On targets that do not have a conditional move/select operations, LLVM compiles the internal conditionalsubu32 function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys. conditionalsubu32 is used...

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Decoder::unpack does not safely contain the paths it extracts, so a malicious NAR archive can create files outside the destination directory — a path traversal CWE-22. In src/dec.rs Decoder::unpack: - A symlink entry's target is written without checking where it points src/dec.rs:153, so the...

BLAKE2b produces wrong tag when using `reset()` with a different-length key

Summary hazardous::mac::blake2b::Blake2b::reset does not correctly reset the state when a key is supplied that has a different length than the one used upon initialization with hazardous::mac::blake2b::Blake2b::new, because it errorneously uses a cached length. Impact Initialization...

wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmmr-87qq-258j For more information see the GitHub-hosted security advisory...

`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

SafeReleaseRepoActions::extractreleasearchive builds each output path from the raw archive entry name and writes to it with no traversal check, so a malicious release archive can create directories and write files outside the destination directory, a "zip-slip" / path traversal CWE-22 / CWE-23. I...

Unbounded memory use on large request bodies

The makegraphqlfilter and makegraphqlfiltersync filters of juniperwarp read the whole body of a POST request into memory before they parsed the body. The filters had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no...