Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
614 results · Clear filters · Feed
-
Medium 5.5
Data races in thex
An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
-
Medium 4.7
Data races in concread
An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
-
Medium 6.8
request smuggling in async-h1
async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applicat…
-
Medium 5.3CVE-2020-26235 Public exploit
Segmentation fault in Rust time crate
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the …
-
Medium 5.3
Argument injection in lettre
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
-
Medium 5.3
Grin allows attackers to adversely affect availability of data on a Mimblewimble blockchain
Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.
-
Medium 5.9
Observable Discrepancy in libsecp256k1-rs
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
-
Medium 4.6
Cargo prior to Rust 1.26.0 may download the wrong dependency
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is u…
-
Medium 5.3
Improper Certificate Validation in security-framework
An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
-
Medium 6.5
Uninitialized memory exposure in claxon
An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.
-
Medium 5.3
Headers containing newline characters can split messages in hyper
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
-
Medium 5.9
Source code is downloaded over cleartext HTTP in portaudio
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
-
Medium 4.8
HTTPS MitM vulnerability due to lack of hostname verification
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
-
Medium 6.5
scalarmult() vulnerable to degenerate public keys
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys