Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
Medium —
owning_ref vulnerable to multiple soundness issues
- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free. - `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free. - `Ownin…
-
High 7.5
Integer overflow when reading corrupted .avro file in Avro Rust SDK
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which add…
-
High 7.5
Memory overconsumption in Avro Rust SDK
It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to ap…
-
High 7.5
Denial of service while reading data in Avro Rust SDK
It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro versi…
-
Unscored —
Interledger is Unmaintained
Interledger family of crates is not being actively maintained anymore. The owner of the published crate does not appear to be responsive. There is an outstanding concern around username comparison. This concern may or may not be resolved by bumping up the dep…
-
High 7.5
`libsqlite3-sys` via C SQLite improperly validates array index
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
-
High 7.5
Memory allocation based on untrusted length in rust-websocket
Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affec…
-
High 7.5
Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow
Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue has been addressed in version 0.15.10. Users are advised to upgrade. Users unable to upgrade should li…
-
High 7.5
async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow
### Impact Executing deeply nested queries may cause stack overflow. ### Patches Upgrade to `v4.0.6`
-
Medium 5.5
WASM3 segmentation fault
WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.
-
Unscored —
Safety issues in `pkcs11`
### Impact The interface of `pkcs11` is subject to a number of safety issues, mainly related to handling of raw pointers. Despite presenting a safe interface, many of the functions and methods that rely on inputs which contain pointers (attributes and mechani…
-
High 7.5
Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs
Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the…
-
Medium 6.4
Use After Free in Wasmtime
Wasmtime is a standalone runtime for WebAssembly. There is a bug in the Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection. This means that if a GC happens at…
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
Critical 9.8
RSA implementation bug in AVX512IFMA instructions
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happe…
-
Medium 4.8
Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime
Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x86_64 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of th…
-
Medium 6.5
Uncontrolled Recursion in rulex
rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the …
-
Medium 6.5
Reachable Assertion in rulex
rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or afte…
-
Unscored —
clipboard is Unmaintained
Last release was almost 4 years ago and the repository with outstanding issues and pull requests seems to be abandoned by the maintainer. In addition the sole maintainer account may be abandoned that may represent account takeover risk. Current outstanding is…
-
Medium —
Use After Free in Context::start_auth_session
### Impact **This issue only applies to applications starting authorization sessions using an explicit initial `nonce`.** When [`Context::start_auth_session`](https://docs.rs/tss-esapi/7.0.1/tss_esapi/struct.Context.html#method.start_auth_session) was called …
-
Critical 9.8
Delegate functions are missing `Send` bound
Affected versions of this crate did not require event handlers to have `Send` bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior. The flaw was corrected in comm…
-
Medium —
tower-http's improper validation of Windows paths could lead to directory traversal attack
`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read…
-
High —
Data race in `Iter` and `IterMut`
In the affected version of this crate, `{Iter, IterMut}::next` used a weaker memory ordering when loading values than what was required, exposing a potential data race when iterating over a `ThreadLocal`'s values. Crates using `Iter::next`, or `IterMut::next`…
-
Low —
Threshold value is ignored (all shares are n=3)
Affected versions of this crate did not properly calculate secret shares requirements. This reduces the security of the algorithm by restricting the crate to always using a threshold value of three, rather than a configurable limit. The flaw was corrected by …
-
Medium —
Stack overflow in rustc_serialize when parsing deeply nested JSON
When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process. Example code that triggers the vulnerability is ```rust fn main() { let _ = rust…
-
Critical —
Miscomputation when performing AES encryption in rust-crypto
The following Rust program demonstrates some strangeness in AES encryption - if you have an immutable key slice and then operate on that slice, you get different encryption output than if you operate on a copy of that key. For these functions, we expect that …
-
High —
A malicious coder can get unsound access to TCell or TLCell memory
This is impossible to do by accident, but by carefully constructing marker types to be covariant, a malicious coder can cheat the singleton check in `TCellOwner` and `TLCellOwner`, giving unsound access to cell memory. This could take the form of getting two …
-
High —
Use after free in Neon external buffers
Neon provides functionality for creating JavaScript `ArrayBuffer` (and the `Buffer` subtype) instances backed by bytes allocated outside of V8/Node. The [`JsArrayBuffer::external`](https://docs.rs/neon/0.10.0/neon/types/struct.JsArrayBuffer.html#method.extern…
-
High —
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid. This allows an attacker to republish an existing `PeerRecord` with a different `Peer…
-
High —
Parser creates invalid uninitialized value
Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate). This is unsound, since `Header` contains references and thus must be non-null. The flaw was corrected by…
-
Critical 9.8
Generated code can read and write out of bounds in safe code
Code generated by flatbuffers' compiler is `unsafe` but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by `flatbuffers` compiler are recommended to: 1. not expose flatbuffer generated c…
-
High —
enum_map macro can cause UB when `Enum` trait is incorrectly implemented
Affected versions of this crate did not properly check the length of an enum when using `enum_map!` macro, trusting user-provided length. When the `LENGTH` in the `Enum` trait does not match the array length in the `EnumArray` trait, this can result in the in…
-
High —
Unsoundness in `dashmap` references
Reference returned by some methods of `Ref` (and similar types) may outlive the `Ref` and escape the lock. This causes undefined behavior and may result in a segfault. More information in [`dashmap#167`](https://github.com/xacrimon/dashmap/issues/167) issue.
-
Medium —
`SegQueue` creates zero value of any type
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` i…
-
Medium —
`SegQueue` creates zero value of any type
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` i…
-
High —
Channel creates zero value of any type
Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`. This is unsound e.g. if `T` is a reference type (which must be non-null). The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` i…
-
High —
Arrow2 allows double free in `safe` code
The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with its custom implementation of `Drop`, resulting in a double free when cloned. Cloning this struct in `safe` results in a segmentation fault, which is unsound. This derive was rem…
-
High —
`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets
`FixedSizeBinaryArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code.
-
High —
`DecimalArray` does not perform bound checks on accessing values and offsets
`DecimalArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16.
-
High —
`BinaryArray` does not perform bound checks on reading values and offsets
`BinaryArray` performs insufficient validation on creation, which allows out-of-bounds reads in safe code.