Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
Low 2.9
SCSIR has a Potential Unsound Issue in WriteSameCommand
In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for group number.
-
Low 2.9
Process Sync has a Potential Unsound Issue in SharedMutex
In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.
-
Low 2.9
memory_pages division by zero
In the memory_pages crate 0.1.0 for Rust, division by zero can occur.
-
Low 2.9
process_lock has a Potential Unsound issue in unlock
The process_lock crate 0.1.0 for Rust allows data races in unlock.
-
High 7.4
Request Smuggling Vulnerability in Pingora
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisonin…
-
Unscored —
surf is unmaintained
The developer has indicated that the crate is unmaintained. The last release is over three years old (from 2021), the crate depends on the deprecated `async-std` crate and on a very old version of `rustls` for TLS support. ## Possible alternatives - [reqwest]…
-
High —
macroquad vulnerable to multiple soundness issues
Several soundness issues have been reported. Resolving them doesn't seem to be considered a priority. In particular, unprincipled use of mutable statics is pervasive throughout the library, making it possible to cause use-after-free in safe code. Currently, n…
-
Medium 6.5
Crossbeam-channel: crossbeam-channel vulnerable to double free on drop
In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
-
Low 3.3
sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single command) can list sudo privileges of other users using the `-U` flag. This vulnerability allows user…
-
Low 3.3
sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders
sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`. Use…
-
Medium 5.3
Ring: some aes functions may panic when overflow checking is enabled in ring
A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out o…
-
Low 2.9
libsql-sqlite3-parser crash due to invalid UTF-8 input
dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.
-
Low 2.9
trailer mishandles allocating with a size of zero
lib.rs in the trailer crate through 0.1.2 for Rust mishandles allocating with a size of zero.
-
Low 2.9
wgp race condition in inner::drop
inner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.
-
Medium —
fast_id_map has a soundness issue and is unmaintained
`FastMap::get()` lacks sufficient checks to its parameter index and is used to unsafely get a `Vec` element. `fast_id_map` is unmaintained.
-
Low —
scanner has a Public API without sufficient bounds checking
`Match::get()` and `Match::ptr()` lack sufficient bounds checks, leading to potential out of bounds reads.
-
Medium 4.9
Mithril snapshots for Cardano database could be compromised by an adversary
### Impact #### Mithril certification of Cardano database The Mithril network provides certification for snapshots of the Cardano database, enabling users to quickly bootstrap a Cardano node without relying on the slower peer-to-peer synchronization process. …
-
Low —
Redox UEFI Safe API can cause heap-buffer-overflow
ffi::nstr() should be marked unsafe, since a pointer to a buffer without a trailing 0 value will cause a heap buffer overflow.
-
Medium —
tanton_engine has unsound public API
The following functions in the `tanton_engine` crate are unsound due to lack of sufficient boundary checks in public API: - `Stack::offset()` - `ThreadStack::get()` - `RootMoveList::insert_score_depth()` - `RootMoveList::insert_score()` The tanton_engine crat…
-
Unscored —
soundness issue
`mod3d_base::BufferData::as_ptr` lack of sufficient checks to its public self field `byte_offset` and used unsafely to do the pointer calculation.
-
Unscored —
soundness issue and unmaintained
`wren_rust::macros::_default_realloc()` lacks sufficient checks to it pointer parameter which passed into `free` and `realloc` `wren_rust` is unmaintained.
-
High 7.8
OpenVM byte decomposition of pc in AUIPC chip can overflow
OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte decomposition of pc in AUIPC chip. A typo results in the highest limb of pc being range checked to 8-b…
-
Low 2.9
obfstr Type Confusion vulnerability
In the obfstr crate before 0.4.4 for Rust, the obfstr! argument type is not restricted to string slices, leading to invalid UTF-8 conversion that produces an invalid value.
-
Medium —
Panic in mp3-metadata due to the lack of bounds checking
The `get_id3()` methods used by `mp3_metadata::read_from_slice()` does not perform adequate bounds checking when recreating the tag due to the use of desynchronization. Fixed in [Fix index error](https://github.com/GuillaumeGomez/mp3-metadata/pull/37), releas…
-
Unscored —
rustc-serialize is unmaintained
`rustc-serialize` will no longer be maintained as declared by the developer. By fuzzing the package, we can identify multiple vulnerabilities. The project has been archived and cannot submit issues. The developer has recommended using the `serde` crate instea…
-
Unscored —
`hugepage_rs::dealloc` may allow invalid memory deallocation from safe code
`hugepage_rs::dealloc` was a publicly accessible safe function. It accepted an arbitrary raw pointer and `Layout`, then forwarded them to the hugepage allocator's `GlobalAlloc::dealloc` implementation. `GlobalAlloc::dealloc` requires callers to ensure that th…
-
Unscored —
`FormatContext` stream accessors can cause undefined behavior from safe code
Affected versions of `stainless_ffmpeg` exposed several safe public methods on `FormatContext` that accepted a `stream_index` parameter and used it in unsafe pointer operations without checking whether the index was valid. These methods performed pointer arit…
-
Unscored —
`DTriangle` accessors may read out of bounds in affected versions
In affected versions, `DTriangle::neighbor_by_order` and `DTriangle::vertex_by_order` were public safe functions that accepted an arbitrary `order` value. These functions used `order` to access fixed-size internal arrays with `get_unchecked`, without checking…
-
Unscored —
`VMABuffer::set_data` may allow out-of-bounds writes from safe code
`VMABuffer::set_data` was a publicly accessible safe function. It accepted an arbitrary `offset` and a data slice, then used the offset in unsafe pointer arithmetic before copying the slice into a mapped allocation. Affected versions did not check that the re…
-
Medium 6.5
pleezer allows resource exhaustion through uncollected hook script processes
pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versions before 0.16.0, these scripts were spawned without proper process cleanup, leaving zombie process…
-
High 7.5
Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused name…
-
High —
tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators
Name: ISA-2025-003: Malicious validator can spoof votes from other validators Component: tendermint-rs Criticality: High (Catastrophic Impact; Rare Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md)…
-
Medium —
Lemmy user purging users or communities or banning users can delete images they didn't upload/exclusively use
### Summary An improper uploaded media ownership check can result in inadvertent deletion of media when a user is banned with content removal or purged. This can lead to deletion of media that was not uploaded by the banned/purged user. This also applies to p…
-
Low —
Tokio broadcast channel calls clone in parallel, but does not require `Sync`
The broadcast channel internally calls `clone` on the stored value when receiving it, and only requires `T:Send`. This means that using the broadcast channel with values that are `Send` but not `Sync` can trigger unsoundness if the `clone` implementation make…
-
High 7.5
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused name…
-
High 7.5
Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (…
-
High 7.5
Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibiti…
-
High 7.5
apollo-compiler Named Fragment Processing Vulnerability
apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. Named fragments were being p…
-
Medium 6.8
Jujutsu does not have SHA-1 collision detection
### Summary Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks. ### Details This is a result of the underlying [CVE-2025-31130 / GHSA-2…
-
Medium —
rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`
When a `Some(...)` value was passed to the `properties` argument of either of these functions, a use-after-free would result. In practice this would nearly always result in OpenSSL treating the properties as an empty string (due to `CString::drop`'s behavior)…