Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
High —
RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover
## Summary `ListServiceAccount` (`GET /rustfs/admin/v3/list-service-accounts?user=<other>`) authorizes cross-user requests against `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction` at `rustfs/src/admin/handlers/service_account.rs:9…
-
High —
Diesel's SQLite backend has possible UTF-8 corruption
Diesel uses the `sqlite3_value_text` function to receive strings from SQLite while deserializing query results. We misinterpreted the corresponding [SQLite](https://sqlite.org/c3ref/value_blob.html) documentation that this function always returns a UTF-8 enco…
-
Medium 5.3
Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
-
Low —
sequoia-git has broken hard revocation handling
Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy is expensive and a project's policy rarely changes, `sq-git` has an optimization to only check a policy if it hasn't checked it before. It d…
-
Critical —
`mysten-metrics` was removed from crates.io for malicious code
`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.
-
Critical —
`sui-execution-cut` was removed from crates.io for malicious code
`sui-execution-cut` included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.
-
Unscored —
sized-chunks is unmaintained
The sized-chunks crate is unmaintained; all versions are affected. The GitHub repository was archived by the owner on 2026-05-03. Recommended alternative: * [imbl-sized-chunks](https://crates.io/crates/imbl-sized-chunks), a popular fork of this crate
-
Unscored —
im-rc is unmaintained
The im-rc crate is unmaintained; all versions are affected. The GitHub repository was archived by the owner on 2026-05-03. [imbl](https://crates.io/crates/imbl) is a maintained fork of the im crate, but we're not aware of maintained alternative to im-rc at th…
-
Unscored —
smartstring is unmaintained
The smartstring crate is unmaintained; all versions are affected. The GitHub repository was archived by the owner on 2026-05-03. Recommended alternatives: * [compact_str](https://crates.io/crates/compact_str) * [smol_str](https://crates.io/crates/smol_str)
-
Unscored —
im is unmaintained
The im crate is unmaintained; all versions are affected. The GitHub repository was archived by the owner on 2026-05-03. Recommended alternative: * [imbl](https://crates.io/crates/imbl) is a maintained fork of this crate
-
Unscored —
bitmaps is unmaintained
The bitmaps crate is unmaintained; all versions are affected. The GitHub repository was archived by the owner on 2026-05-03. Recommended alternatives: * [fixedbitset](https://crates.io/crates/fixedbitset) * [bitvec](https://crates.io/crates/bitvec)
-
Unscored —
Null-pointer dereference and double-free via safe APIs
Two soundness violations exist in the Rust bindings for MetaCall: **Null-pointer dereference:** `MetaCallFuture::new_raw()` accepts a raw pointer without validation. The `Debug` impl calls `Box::from_raw(self.data)` on it. Passing a null pointer causes the `D…
-
Unscored —
Invalid pointer arithmetic in `iter()` and `iter_mut()`
The `iter()` and `iter_mut()` APIs compute `current = (&children[0] as *const *const RawAutoChild).sub(1)`, which performs pointer subtraction going before the start of the allocation. This is undefined behavior per Rust's pointer arithmetic rules. This can b…
-
Unscored —
Double-free in `Chomp::inner()`
`Chomp::inner()` uses `std::ptr::read_unaligned` to move out the value from a raw pointer. If the original value is an owned type (e.g. `Box`), calling `inner()` moves out the ownership, but the original variable will still be dropped at the end of its scope.…
-
Unscored —
Out-of-bounds read/write in `Index` and `IndexMut` implementations
The `Index` and `IndexMut` implementations for `Caja` use unchecked pointer arithmetic without bounds validation. Creating a `Caja` with a small key and then accessing an out-of-range index causes out-of-bounds reads or writes beyond the allocated memory. Thi…
-
Unscored —
Buffer overflow in `Clusterings::from_i32_column_major_order()`
The `from_i32_column_major_order` method can create inconsistent internal state. When `labels` length and `n_items` mismatch, `n_clusterings` becomes `labels.len() / n_items` (truncated), but subsequent calls to `label()` use indices that exceed the internal …
-
Unscored —
Double-free and use-after-free in `Keys::next()`
`Keys::next()` uses `ptr::read` to move out the `Option<V>` by value, which drops the contained `V` when `V` is non-Copy (e.g. `String`). This leaves a dangling value in the map's storage slot. Subsequent `get()` operations on that key return a dangling refer…
-
Unscored —
Integer overflow in `array::ReadWrite::new()` leading to potential memory corruption
In `array::ReadWrite::new()` (line 83 of `accessor/src/array.rs`), `let bytes = mem::size_of::<T>() * len` can overflow `usize` when `len` is very large. In release mode, this silently wraps, potentially making `bytes = 0`. The mapper then maps with 0 bytes, …
-
Unscored —
Out-of-bounds read in `bytes_helper` public safe functions
The `bytes_helper` module contains multiple public functions (`into_arr4()`, `into_arr2()`, `u8_from_le_bytes()`) that use `slice.get_unchecked(pos..pos + N)` without verifying that `pos + N <= slice.len()`. These are public safe API functions, allowing any c…
-
Unscored —
Unsound access to padding bytes while serializing date/time values using the Mysql backend
Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized bina…
-
Unscored —
AVX2 Implementation Did Not Fully Reduce Intermediate Values
The AVX2 implementation of ML-DSA did not fully reduce intermediate inputs to the inverse NTT, which leads to a testable difference in panic behaviour of internal functions compared to the portable implementation. ## Impact We are not aware of inputs to the p…
-
Medium 4.0
Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation
Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.
-
Medium 5.9
Missing Delegated Metadata Validation in awslabs/tough
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for delegated targets metad…
-
Medium 5.3
Signature Threshold Bypass in awslabs/tough Delegated Roles
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signature, causing the cl…
-
High 8.3
rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines can cause OpenSSL to leak adjacent memory to the network peer
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callback, set_cookie_generate_cb, and set_stateless_cookie_generate_…
-
High 8.1
rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller than that, MdCtxRef::digest_final() writes past its end, usuall…
-
High 7.2
rust-openssl: Incorrect bounds assertion in aes key wrap
rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this condition is reversed. The intended invariant is out.len()…
-
Low 1.7
rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that returns a value larger than the buffer i…
-
High 7.2
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to EVP_PKEY_derive, relying on OpenSSL to honor it. On Op…
-
Unscored —
Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend
Diesel allows users to output the generated SQL for any query DSL construct via th `diesel::debug_query` function as `Display` and `Debug` output. For the particular implementation used by batch Insert statements in the SQLite backend Diesel relied on an unsp…
-
Unscored —
Unsound access to padding bytes while serializing date/time values using the Mysql backend
Diesel relies on libmysqlclient for interacting with Mysql compatible databases. This library requires to provide date/time values according to the byte layout of their `MYSQL_TIME` type. Diesel replicated this type as `#[repr(C)]` struct, populated all the f…
-
Unscored —
bare-metal is deprecated
The `bare-metal` crate has been deprecated and archived. For `Mutex` and `CriticalSection`, see the [`critical-section`](https://crates.io/crates/critical-section) crate instead.
-
Critical 9.3
Brillig: Heap corruption in foreign call results with nested tuple arrays
Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can invoke external functions through foreign calls. When compili…
-
High 8.3
RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (access key + se…
-
Medium 6.8
nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge
nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts `UpdateValidator` transactions that set `new_voting_key=Some(...)` while omitting `new_proof_of_knowledge`. th…
-
Low 3.1
nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatch
nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a malformed proof where `history.len() != positions.len()` due to `assert_eq!(history.len(), positions…
-
Medium 5.3
nimiq-blockchain: Peer-triggerable panic during history sync
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block bein…
-
High 7.5
nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals
nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validators` set contains a…
-
Medium 5.3
nimiq-account: Vesting insufficient funds error can panic
nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingContract::can_change_balance` returns `AccountError::InsufficientFunds` when `new_balance < min_cap`, but it constructs the error using `balan…
-
Critical 9.6
nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot lookup. Pri…