Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
196 results · Clear filters · Feed
-
Low 2.9
RustFS RPC signature verification logs shared secret
RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers and enables forged RP…
-
Low 3.3
lief-project LIEF ELF Binary Parser.tcc parse_binary null pointer dereference
A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parse_binary of the file src/ELF/Parser.tcc of the component ELF Binary Parser. The manipulation results in null pointer dereference. The att…
-
Low —
mnl has segmentation fault and invalid memory read in `mnl::cb_run`
The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers. Passing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input bu…
-
Low 3.7
AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value
## **Summary** This notification is related to the use of specific values for the region input field when calling AWS services. An actor with access to the environment in which the SDK is used could set the region input field to an invalid value. A defense-in…
-
Low 2.7
rsa crate has potential panic on a prime being equal to 1
The `rsa` crate is an RSA implementation written in rust. Prior to version 0.9.10, when creating a RSA private key from its components, the construction panics instead of returning an error when one of the primes is `1`. Version 0.9.10 fixes the issue.
-
Low —
`IterMut` violates Stacked Borrows by invalidating internal pointer
Affected versions of this crate contain a soundness issue in the `IterMut` iterator implementation. The `IterMut::next` and `IterMut::next_back` methods temporarily create an exclusive reference to the key when dereferencing the internal node pointer. This in…
-
Low 1.3
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denial-of-service condit…
-
Low —
maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe
maxminddb prior to version 0.27 declared `Reader::open_mmap` as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while …
-
Low —
rtvm-interpreter lacks sufficient checks in public API
The affected function is unsound due to insufficient checks on public struct field.
-
Low 1.8
Wasmtime provides unsound API access to a WebAssembly shared linear memory
Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host …
-
Low 3.8
sudo-rs: Partial password reveal is possible after timeout
sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happe…
-
Low —
Shaman has soundness issues and is unmaintained
`shaman::cryptoutil::write_u64v_le` and other functions mentioned above cannot garantee memory safety of get_unchecked later if both length are zero. `shaman` is unmaintained.
-
Low 2.1
Wasmtime vulnerable to segfault when using component resources
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which when called in a spec…
-
Low —
Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice
The safe function `any_as_u8_slice` can create byte slices that reference uninitialized memory when used with types containing padding bytes. The function uses `slice::from_raw_parts` to create a `&[u8]` covering the entire size of a type, including padding b…
-
Low —
Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer
The safe function `create_ring_buffer` allocates a buffer using `Vec::with_capacity` followed by `set_len`, creating a `Box<[T]>` containing uninitialized memory. This leads to undefined behavior when functions like `write_slices` create typed slices (e.g., `…
-
Low —
orx-pinned-vec has undefined behavior in index_of_ptr with empty slices
The safe function `index_of_ptr` causes undefined behavior when called with an empty slice. The issue occurs in the line `ptr.add(slice.len() - 1)` which underflows when `slice.len()` is 0, creating a pointer with a massive offset. According to Rust's safety …
-
Low —
tracexec has `env` command argument injection via environment variables starting with dash in traced exec events
### Impact For tracexec's command line reconstruction feature, when a traced process executes another process with a environment variable where the key starts with a dash, tracexec incorrectly shows its commandline where such environment variables could cause…
-
Low 3.3
Deno's --deny-read check does not prevent permission bypass
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats…
-
Low 3.3
Deno's --deny-write check does not prevent permission bypass
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to c…
-
Low 1.0
Wasmtime has memory leak in C API with `externref` and `anyref` types
Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 37.0.1 have memory leaks in the C/C++ API when using bindings for the `anyref` or `externref` WebAssembly values. This is caused by a regression introduced during the development of 37.0.0 and all pri…
-
Low —
wrflib has a soundness issue and is unmaintained
All functions under `wrflib::byte_extract` are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter. `wrflib` is unmaintained.
-
Low —
Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal
Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for differences between HTML, SVG, and MathML. This vulnerability only has an effect when the `svg` or `math` tag is a…
-
Low 2.7
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalized_power_level()` method can cause a panic if a room member has a power level of `Int::Min`. The issue is fixed in matri…
-
Low 2.3
Tracing logging user input may result in poisoning logs with ANSI escape sequences
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape…
-
Low —
Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constructors or on the drop of `Connection`, it closes the associated file descriptor. Thus, a program which uses an `…
-
Low 2.7
RISC Zero Underconstrained Vulnerability: Division
RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 c…
-
Low 3.7
Netavark: podman: netavark may resolve hostnames to unexpected hosts
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container w…
-
Low 2.9
sequoia-openpgp vulnerable to out-of-bounds array access leading to panic
The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
-
Low 2.9
buffered-reader vulnerable to out-of-bounds array access leading to panic
The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
-
Low 2.9
Low severity (DoS) vulnerability in sequoia-openpgp
The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
-
Low 3.7
CosmWasm affected by arithmetic overflows
The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
-
Low 2.9
curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`
The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.
-
Low 3.2
Multiple issues involving quote API in shlex
The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
-
Low 3.1
Unauthenticated Nonce Increment in snow
The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
-
Low 3.2
serde-json-wasm stack overflow during recursive JSON parsing
The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
-
Low 3.5
Wasmtime has host panic with `fd_renumber` WASIp1 function
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The specific bug is triggere…
-
Low —
static-alloc vulnerability leads to uninitialized read after allocating MemBump
The affected function, `MemBump::new()`, would allocate memory without initializing it. Subsequently calling the created value's various `alloc`methods would then read and write the start of that memory as a `Cell` which isundefined behavior. Instead, it shou…
-
Low 1.7
risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitment
RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration. The risc0-ethereum repository contains Solidity verifier contracts, Steel EVM view call library, and supporting code. Prior to versions 2.1.1 and 2.2.0, the `Steel…
-
Low 1.7
Letmein connection limiter allows an arbitrary amount of simultaneous connections
Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Th…
-
Low 2.7
spytrap-adb Omission of Security-relevant Information
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface.