Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
571 results · Clear filters · Feed
-
High 7.5
Null pointer deference in cache
An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced.
-
High 7.5
Null pointer deference in av-data
An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault.
-
High 7.5
Double free in basic_dsp_matrix
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
-
High 7.5
Double free in fil-ocl
An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free.
-
High 8.2
XSS in mdBook's search page
mdBook is a utility to create modern online books from Markdown files and is written in Rust. In mdBook before version 0.4.5, there is a vulnerability affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code o…
-
High 7.5
Out of bounds write in serde_cbor
An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.
-
High 7.5
libsecp256k1 contains side-channel timing attack
An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.
-
High 7.5
Counter overflow in chacha20
An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
-
High 7.5
Incorrect implementation in streebog
An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
-
High 7.5
Out of bounds read in bumpalo
An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.
-
High 7.5
Dangling reference in flatbuffers
An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
-
High 7.5
os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`
An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. It has false expectations about char::from_u32_unchecked behavior.
-
High 8.1
Use after free in internment
An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free.
-
High 7.5
Excessive memory usage in tokio-rustls
An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly.
-
High 8.1
Data races in rocket
An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
-
High 8.1
Memory safety violation in crayon
An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike.
-
High 7.5
Double free in ordnung
An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via out-of-bounds access for large capacity.
-
High 7.5
Unaligned references in Obstack
An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur.
-
High 7.5
Insufficient size checks in ws
An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack.
-
High 7.5
Use-after-free in actix-http
An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.
-
High 7.8
futures_task::waker may cause a use-after-free if used on a type that isn't 'static
An issue was discovered in the futures-task crate before 0.3.6 for Rust. futures_task::waker may cause a use-after-free in a non-static type situation.
-
High 7.5
Unexpected panic in multihash
An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server.
-
High 7.5
Stack consumption in trust-dns-server
An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
-
High 7.5
Dangling reference in `access::Map` with Constant
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling reference…
-
High 8.1
Undefined Behavior in bounded Crossbeam channel
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not act…
-
High 7.5
Array size is not checked in sized-chunks
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
-
High 7.5
Grin insufficient data validation
Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.
-
High 8.6
Improper verification of signature threshold in tough
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures be…
-
High 7.5
Improper Synchronization and Race Condition in vm-memory
rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
-
High 7.5
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…
-
High 7.5
Grin Insufficient Validation
Grin through 2.1.1 has Insufficient Validation.
-
High 7.5
Use after free in string-interner
An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.
-
High 7.5
Uninitialized memory use in generator
An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
-
High 7.5
Improper Input Validation in once_cell
An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.
-
High 7.5
Wrong memory orderings violates mutual exclusion in spin
An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
-
High 7.5
Integer underflow in untrusted
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
-
High 7.5
Improper Input Validation in cookie
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
-
High 7.5
Uncontrolled recursion in ammonia
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
-
High 7.5
Uncontrolled memory consumption in protobuf
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
-
High 7.5
Failure to properly verify ed25519 signatures in libp2p-core
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.