Ecosystem
crates.io
2,067 known vulnerabilities.
Most affected packages
2,066 results · Feed
-
Medium 6.9
actix-files before 0.6.10 Denial of Service via empty Range header
actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range…
-
Medium 4.3
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal …
-
Medium 5.3
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve25519.rs accepts the a…
-
Medium 5.3
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::compute_shared_…
-
Unscored —
Memory corruption bug on `ApplyResult` type
The `ApplyResult` type contains a raw pointer to a C++ memory object and has a derived `Clone` implementation which creates a reference to this object without incrementing the associated reference counter. As a result, if an instance of `ApplyResult` is dupli…
-
Medium 4.6
Inverted bitmap validation in `invalidate_l2_cached_ept`
Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation …
-
Medium 4.6
`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`
Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation…
-
Medium 6.1
SWC HTML minifier may allow script element breakout when minifying embedded JSON
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in applicati…
-
Unscored —
`sp-sized-chunks` is unmaintained
The `sp-sized-chunks` crate is a fork of `sized-chunks`. Its repository is archived and the crate is no longer maintained. Users should migrate to [`imbl-sized-chunks`](https://crates.io/crates/imbl-sized-chunks), a maintained fork.
-
Unscored —
Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)
Several methods in `circular-buffer` drop elements before updating the buffer's start/end metadata. If an element's `Drop` panics during the drop, the metadata update is skipped, so the buffer still treats the already-dropped elements as live. When the buffer…
-
Unscored —
Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)
Several methods in `sized-chunks` drop elements before updating the length/boundary metadata. If an element's `Drop` panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container…
-
Unscored —
Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)
Several methods in `sp-sized-chunks` drop elements before updating the container's length/boundary metadata. If an element's `Drop` panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. Whe…
-
Unscored —
Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)
`SplitVec::extend_from_slice` increments the logical length `self.len` before cloning the incoming elements into the reserved slots. If an element's `Clone` panics mid-fill, unwinding leaves `self.len` counting slots that were never initialized. A later safe …
-
Unscored —
Safe ErrorRegistry APIs can cause undefined behavior
All published versions of `dcrypt-api` before 2.0.0 exposed safe `ErrorRegistry` operations that could trigger undefined behavior when the default `std` feature was enabled. Stored `Box<E>` values were erased to raw pointers and later deallocated as `Box<()>`…
-
Unscored —
Ed25519 identity public keys permit universal signature forgery
All published versions of `dcrypt-sign` before 2.0.0 accepted the Edwards identity as an Ed25519 public key. A signature with `R = B` and `S = 1` then verified for every message because the challenge term multiplied the identity. The implementation also admit…
-
Unscored —
Streaming AEAD does not authenticate stream structure
In all published versions of `dcrypt-symmetric` before 2.0.0, version-1 GCM and ChaCha20-Poly1305 streams used unauthenticated terminator, counter, and length fields. Decryptors trusted transmitted counters, allocated from unbounded lengths, and discarded pla…
-
Unscored —
Low-level GCM ignores the operation nonce
In all published versions of `dcrypt-algorithms` before 2.0.0, the low-level `Gcm` builder required an operation nonce but derived `J0` from the nonce captured by the original `Gcm` constructor. Multiple operations could therefore silently reuse a nonce even …
-
Unscored —
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences
Affected versions of `kuva` wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input (column headers, category and group names, series labels) were affected in three places. *…
-
Unscored —
`sevenz-rust` is unmaintained
The `sevenz-rust` repository has been deleted and the crate is no longer actively maintained. Users should migrate away from the library in favor of a modern up-to-date 7z library such as `sevenz-rust2`.
-
Unscored —
Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.
## Summary All versions of `sevenz-rust` fail to validate file paths when extracting in `decompress_impl` (the underlying function used in the exposed decompress api functions). This oversight allows a maliciously crafted archive to extract outside the extrac…
-
Unscored —
`setlocale` and `TextDomain::init` are unsound as they access environment with no synchronization
`setlocale` and `TextDomain::init` are unsound and may allow safe code to exhibit undefined behavior when called in a multi-threaded program. The flaw is fixed in 0.8.0 by marking these functions `unsafe` and documenting the conditions under which they can be…
-
High 7.5
A `BigInt` division panics, and two neighbouring operations answer wrongly in silence
`viperjs` is a JavaScript engine intended to run untrusted script inside a host application, so script text is data rather than a trusted caller and a panic reachable from script is a denial of service in the embedder's process. A divisor whose magnitude land…
-
Unscored —
Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
`ReadChunk::commit` and `ReadChunk::commit_all` drop the committed elements before advancing the consumer head. If an element's `Drop` panics during the drop loop, `head` is never advanced, so the ring buffer still treats those slots as holding live elements.…
-
Medium 6.5
Russh: Channel-scoped server callbacks can be reached without an open channel
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and the exec_request cal…
-
Unscored —
Auto-Reseeding HMAC-DRBG could panic for some output lengths
The automatically reseeding implementations of HMAC-DRBG would panic if called with a desired non-zero output length cleanly divisible by `65_536`, the maximum number of output bytes that can be generated before reseeding has to happen. # Impact An applicatio…
-
Unscored —
`nostr-relay-pool` is unmaintained
The `nostr-relay-pool` crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into [`nostr-sdk`](https://crates.io/crates/nostr-sdk) starting with version `0.45.0`. Users should migrate to [`nostr-sdk`](https://c…
-
Unscored —
`nostr-keyring` is unmaintained
The `nostr-keyring` crate is no longer actively maintained.
-
Unscored —
`nostr-relay-builder` is unmaintained
The `nostr-relay-builder` crate is no longer actively maintained as a standalone crate. Its functionality has been incorporated into [`nostr-sdk`](https://crates.io/crates/nostr-sdk) starting with version `0.45.0`. Users should migrate to [`nostr-sdk`](https:…
-
High 7.5
Processing of unverified relay events
The processed events received from a relay through admission-policy and database paths before verifying that the serialized fields matched the claimed event ID and signature. In particular, a database result for the claimed ID could cause verification to be s…
-
High 7.5
Relay authentication challenges can exhaust memory
The SDK forwarded every NIP-42 `AUTH` challenge received from a relay through an unbounded command queue. Challenge handling can wait for an asynchronous signer or user interaction, so receiving challenges was substantially faster than completing the correspo…
-
High 7.5
Empty NIP-50 search filters can panic
The NIP-50 event-matching path searched event content with `slice::windows(search.len())`. An empty search string therefore called `slice::windows(0)`, which always panics instead of returning a match result. A remote client able to submit filters to an appli…
-
High 7.5
NIP-98 authorization parsing permits resource exhaustion
The NIP-98 HTTP authorization parser Base64-decoded the complete authorization value and parsed the resulting JSON event without applying an application-level size limit. Both operations occurred before the event's signature and authorization fields could be …
-
Medium 4.3
NIP-04 parsing amplifies malformed ciphertext memory use
The NIP-04 decryption parser split attacker-controlled content on every `?iv=` separator and collected all resulting segments before checking that the message had the expected two parts. It also Base64-decoded the complete IV text before checking that it repr…
-
High 7.5
NIP-44 v2 decryption permits resource exhaustion
The NIP-44 decryption entry point Base64-decoded the complete attacker-controlled payload before determining its version or enforcing any size limit. For v2 payloads, the decoded buffer was then authenticated with HMAC even when it was much larger than the ma…
-
High 7.5
Wallet event parsers accept unauthenticated events
The NIP-47 response and notification parsers and the NIP-60 wallet event parsers decrypted relay-provided events before verifying their kind, computed event ID, signature, and expected wallet public key. The decryption peer was derived from the untrusted even…
-
Medium 5.5
Debug output exposes NIP-46 and NIP-60 credentials
Several NIP-46 and NIP-60 types used derived `Debug` implementations even though their fields contained credentials or decrypted application data. Formatting these values exposed NIP-46 connection secrets and request parameters, as well as NIP-60 private keys…
-
High 7.5
Verification cache poisoning allows forged Nostr events to bypass signature validation
The `nostr-relay-pool` crate cached the result of event signature verification before the check was actually performed. Because the entry was inserted unconditionally, a first delivery whose signature failed was still recorded in the cache. A subsequent deliv…
-
Medium —
zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit
### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has **no recursion depth limit** and **no cycle detection**. A malicious or buggy valida…
-
High 7.5
Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a denial of service …
-
Unscored —
Unix `BROWSER` handling allows browser argument injection
On Unix platforms handled by `src/unix.rs`, affected versions substitute the caller-supplied URL into the `BROWSER` environment-variable template before tokenizing the resulting string with `split_ascii_whitespace()`. If an application passes an attacker-cont…