Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
High —
scaly: Multiple soundness issues in Rust safe APIs
Affected versions contain multiple safe APIs that can trigger undefined behavior: - `Array<T>::index` can perform an out-of-bounds read. - `String::get_length` can perform an out-of-bounds read. - `String::append_character` can perform an invalid write. - `St…
-
High 8.2
libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to version 0.49.4, the Rust libp2p Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After a peer sends a crafted PRUNE contr…
-
High 8.4
Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-consensus version 5.0.1, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By matching a valid transaction…
-
Critical 9.2
Zebra node crash — V5 transaction hash panic (P2P reachable)
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (crash). This is trig…
-
Unscored —
Symbol confusion after hasher panic in `intaglio` interners
Affected versions of this crate can leave all `SymbolTable` variants in an internally inconsistent state if a custom `BuildHasher` panics during `HashMap::insert` and the caller recovers with `catch_unwind`. The `intern` implementations committed a `vec.push(…
-
Critical —
mpp has multiple payment bypass and griefing vulnerabilities
### Impact Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including: - Performing free `tempo/charge` requests - Replaying existing `tempo/charge` requests - Performing free `tempo/session` requests - Piggybacking off existi…
-
Medium 6.5CVE-2026-33693 Public exploit
Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlli…
-
Medium —
Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery
### Impact In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web content is prevented from reading the request's response due to the Cros…
-
High —
libcrux has an Incorrect Check of Signer Response Norm During Verification
The ML-DSA verification algorithm as specified in [FIPS 204, subsection 6.3](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf#subsection.6.3) requires verifiers to check that the infinity norm of the deserialized signer response $z$ does not exceed $\…
-
High —
libcrux Panics During Standalone MAC Operations
An incorrect constant for the key length in libcrux-poly1305 caused the standalone MAC function `libcrux_poly1305::mac` to always panic with an out-of-bounds memory access. ## Impact Applications wishing to use libcrux-poly1305 as a standalone MAC would exper…
-
High —
libcrux-sha3: Incorrect output from SHAKE squeeze functions
The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than `RATE` (168 for SHAKE128, 136 for SHAKE256) bytes, performed an additional permutation of the state before producing the first output block, thus discarding …
-
High —
libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure
The libcrux-ed25519 key generation samples Ed25519 secret keys from a provided CSPRNG in a loop for up to 100 attempts until a non-zero key is found. If a non-zero key could not be sampled within 100 attempts the key generation function would silently continu…
-
High —
libcrux: Panic in Signature Hint Decoding During Verification
During ML-DSA verification the serialized hint values are decoded as specified in algorithm 22 `HintBitUnpack` of [FIPS 204, subsection 7.1](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf#%5B%7B%22num%22%3A120%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%2…
-
High 8.7
Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing
Salvo is a Rust web framework. Prior to version 0.89.3, Salvo's form data parsing implementations (`form_data()` method and `Extractible` macro) do not enforce payload size limits before reading request bodies into memory. This allows attackers to cause Out-o…
-
High 7.5
Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass
Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constraints and acc…
-
High —
AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN
### Summary AWS-LC is an open-source, general-purpose cryptographic library. ### Impact A logic error in CN (Common Name) validation allows certificates with wildcard or raw UTF-8 Unicode CN values to bypass name constraints enforcement. The `cn2dnsid` functi…
-
Unscored —
`tokio-signal` is unmaintained
The [`tokio-signal`](https://crates.io/crates/tokio-signal) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-udp` is unmaintained
The [`tokio-udp`](https://crates.io/crates/tokio-udp) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-executor` is unmaintained
The [`tokio-executor`](https://crates.io/crates/tokio-executor) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-compat` is unmaintained
The [`tokio-compat`](https://crates.io/crates/tokio-compat) crate is unmaintained. It was part of the transition from Tokio 0.1 to 0.2.
-
Unscored —
`tokio-fs` is unmaintained
The [`tokio-fs`](https://crates.io/crates/tokio-fs) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-timer` is unmaintained
The [`tokio-timer`](https://crates.io/crates/tokio-timer) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-tcp` is unmaintained
The [`tokio-tcp`](https://crates.io/crates/tokio-tcp) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-io` is unmaintained
The [`tokio-io`](https://crates.io/crates/tokio-io) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-reactor` is unmaintained
The [`tokio-reactor`](https://crates.io/crates/tokio-reactor) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-codec` is unmaintained
The [`tokio-codec`](https://crates.io/crates/tokio-codec) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the [`tokio-util`](https://crates.io/crates/tokio-util) crate.
-
Unscored —
`tokio-process` is unmaintained
The [`tokio-process`](https://crates.io/crates/tokio-process) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-current-thread` is unmaintained
The [`tokio-current-thread`](https://crates.io/crates/tokio-current-thread) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-tls` is unmaintained
The [`tokio-tls`](https://crates.io/crates/tokio-tls) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-sync` is unmaintained
The [`tokio-sync`](https://crates.io/crates/tokio-sync) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-threadpool` is unmaintained
The [`tokio-threadpool`](https://crates.io/crates/tokio-threadpool) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Unscored —
`tokio-uds` is unmaintained
The [`tokio-uds`](https://crates.io/crates/tokio-uds) crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main [`tokio`](https://crates.io/crates/tokio) crate.
-
Medium 5.1
tar-rs: unpack_in can chmod arbitrary directories by following symlinks
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() fo…
-
Medium 5.1
tar-rs incorrectly ignores PAX size headers if header size is nonzero
tar-rs is a tar archive reading/writing library for Rust. Versions 0.4.44 and below have conditional logic that skips the PAX size header in cases where the base header size is nonzero. As part of CVE-2025-62518, the astral-tokio-tar project was changed to co…
-
High 8.7
libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow
libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.49.3, the Gossipsub implementation accepts attacker-controlled PRUNE backoff values and may perform unchecked time arithmetic when storing backoff …
-
High 8.2
lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library f…
-
Low 1.7
astral-tokio-tar insufficiently validates PAX extensions during extraction
astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be …
-
High 7.4
CRL Distribution Point Scope Check Logic Error in AWS-LC
A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly rejected as out of scope, which allows a revoked certificate to bypass certificate revocation checks. To remediate this issue, users should up…
-
Unscored —
`tracing-ethers` was removed from crates.io due to malicious code
The `tracing-ethers` crate attempted to exfiltrate ssh keys to an app hosted on `vercel.app` The malicious crate had 9 version published on 2026-03-09 approximately 5 days before removal and had no evidence of actual downloads. There were no crates depending …
-
High 8.7
Yamux remote Panic via malformed Data frame with SYN set and len = 262145
Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 2…