Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
571 results · Clear filters · Feed
-
High —
Data race in `Iter` and `IterMut`
In the affected version of this crate, `{Iter, IterMut}::next` used a weaker memory ordering when loading values than what was required, exposing a potential data race when iterating over a `ThreadLocal`'s values. Crates using `Iter::next`, or `IterMut::next`…
-
High —
A malicious coder can get unsound access to TCell or TLCell memory
This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in `TCellOwner` and `TLCellOwner`, giving unsound access to cell memory. This could take the form of getting two …
-
High —
Use after free in Neon external buffers
Neon provides functionality for creating JavaScript `ArrayBuffer` (and the `Buffer` subtype) instances backed by bytes allocated outside of V8/Node. The [`JsArrayBuffer::external`](https://docs.rs/neon/0.10.0/neon/types/struct.JsArrayBuffer.html#method.extern…
-
High —
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid. This allows an attacker to republish an existing `PeerRecord` with a different `Peer…
-
High —
Parser creates invalid uninitialized value
Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate). This is unsound, since `Header` contains references and thus must be non-null. The flaw was corrected by…
-
High —
enum_map macro can cause UB when `Enum` trait is incorrectly implemented
Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length. When the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the in…
-
High —
Unsoundness in `dashmap` references
Reference returned by some methods of `Ref` (and similar types) may outlive the `Ref` and escape the lock. This causes undefined behavior and may result in a segfault. More information in [`dashmap#167`](https://github.com/xacrimon/dashmap/issues/167) issue.
-
High —
Channel creates zero value of any type
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` i…
-
High —
Arrow2 allows double free in `safe` code
The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with its custom implementation of `Drop`, resulting in a double free when cloned. Cloning this struct in `safe` results in a segmentation fault, which is unsound. This derive was rem…
-
High —
`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets
`FixedSizeBinaryArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code.
-
High —
`DecimalArray` does not perform bound checks on accessing values and offsets
`DecimalArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.
-
High —
`BinaryArray` does not perform bound checks on reading values and offsets
`BinaryArray` performs insufficient validation on creation, which allows out-of-bounds reads in safe code.
-
High 8.4
Link Following in Deno
Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.
-
High 7.5
Integer overflow in solana_rbpf
Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
-
High 7.5
Resource leakage when decoding certificates and keys
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes cer…
-
High —
Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
### Impact A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node. ### Patches Upgrade to 0.43.1 or later. ### References After resolving the outpoints of one dep group, we put the corresponding content into a vec…
-
High —
Relative Path Traversal in afire serve_static
### Impact This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible. ### Patches The issue has been fix…
-
High 8.1
Use after free in Wasmtime
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch …
-
High 7.1
Data Loss/Denial of Service in SWHKD
SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
High 7.8
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to …
-
High 8.1
Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils
crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U…
-
High 7.5
Integer overflow in solana_rbpf
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is trigger…
-
High 7.5
Use after free in libpulse-binding
An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
-
High 7.5
Missing Initialization of Resource in pnet
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
-
High 7.5
Panic mishandled in libpulse-binding
An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
-
High 7.5
`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)
An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
-
High 7.5
vec-const attempts to construct a Vec from a pointer to a const slice
An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
-
High 7.5
QueryInterface should call AddRef before returning pointer
An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
-
High 7.5
Window may read from uninitialized memory locations in rdiff
An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
-
High 7.5
Allocation of Resources Without Limits or Throttling in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
-
High 7.5
Process crashes when the cell used as DepGroup is not alive
An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
-
High 7.5
Memory Safety Issue when using `patch` or `merge` on `state` and assign the result back to `state`
An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
-
High 8.1
AtomicBucket<T> unconditionally implements Send/Sync
An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.
-
High 7.5
Abomonation transmutes &T to and from &[u8] without sufficient constraints
An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
-
High 8.1
Race Condition in tokio
An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
-
High 7.5
Panic on incorrect date input to `simple_asn1`
An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
-
High 7.5
RustEmbed generated `get` method allows for directory traversal when reading files from disk
An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.
-
High 7.5
Use After Free in rusqlite
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.