Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
Medium 5.5
socket2 invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the net2 crate before 0.2.36 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
miow invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
mio invalidly assumes the memory layout of std::net::SocketAddr
An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
-
Medium 5.5
ordered_float:NotNan may contain NaN after panic in assignment operators
An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
-
Medium 5.5
Data races in try-mutex
An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type.
-
Medium 5.5
Data races in magnetic
An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
-
Medium 5.1
Improper random number generation in nanorand
An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
-
Medium 5.5
Data races in thex
An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
-
Medium 4.7
Data races in concread
An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
-
High 7.5
Stack consumption in trust-dns-server
An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
-
High 7.5
Dangling reference in `access::Map` with Constant
An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling reference…
-
Unscored —
stderr is unmaintained; use eprintln instead
The `stderr` crate is no longer maintained by its current owner. The author recommends using the `eprintln` macro from the standard library as a replacement.
-
Medium 6.8
request smuggling in async-h1
async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applicat…
-
Unscored —
difference is unmaintained
The author of the `difference` crate is unresponsive. Maintained alternatives: - [`dissimilar`](https://crates.io/crates/dissimilar) - [`similar`](https://crates.io/crates/similar) - [`treediff`](https://crates.io/crates/treediff) - [`diffus`](https://crates.…
-
Unscored —
crate has been renamed to `sn_client`
This crate has been renamed from `safe_core` to `sn_client`. The new repository location is: <https://github.com/maidsafe/sn_client>
-
Unscored —
crate has been renamed to `sn_node`
This crate has been renamed from `safe_vault` to `sn_node`. The new repository location is: <https://github.com/maidsafe/sn_node>
-
Unscored —
crate has been superseded by `sn_client`
This crate has been superseded by `sn_client`. The new repository location is: <https://github.com/maidsafe/sn_client>
-
Unscored —
crate has been superseded by `sn_client`
This crate has been superseded by `sn_client`. The new repository location is: <https://github.com/maidsafe/sn_client>
-
Unscored —
memmap is unmaintained
The author of the `memmap` crate is unresponsive. Maintained alternatives: - [`memmap2`](https://github.com/RazrFalcon/memmap2-rs)
-
Medium 5.3CVE-2020-26235 Public exploit
Segmentation fault in Rust time crate
In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the …
-
Medium 5.3
Argument injection in lettre
The lettre library through 0.10.0-alpha for Rust allows arbitrary sendmail option injection via transport/sendmail/mod.rs.
-
Unscored —
Potential segfault in `localtime_r` invocations
### Impact Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowled…
-
Unscored —
`term_size` is unmaintained; use `terminal_size` instead
The [`term_size`](https://crates.io/crates/term_size) crate is no longer maintained. Consider using [`terminal_size`](https://crates.io/crates/terminal_size) instead.
-
Unscored —
crate has been renamed to `sn_routing`
This crate has been renamed from `routing` to `sn_routing`. The new repository location is: <https://github.com/maidsafe/sn_routing>
-
Unscored —
crate has been renamed to `qp2p`
This crate has been renamed from `quic-p2p` to `qp2p`. The new repository location is: <https://github.com/maidsafe/qp2p>
-
Unscored —
crate has been renamed to `sn_bindgen`
This crate has been renamed from `safe_bindgen` to `sn_bindgen`. The new repository location is: <https://github.com/maidsafe/sn_bindgen>
-
Unscored —
crate has been renamed to `sn_fake_clock`
This crate has been renamed from `fake_clock` to `sn_fake_clock`. The new repository location is: <https://github.com/maidsafe/sn_fake_clock>
-
Unscored —
crate has been renamed to `sn_ffi_utils`
This crate has been renamed from `ffi_utils` to `sn_ffi_utils`. The new repository location is: <https://github.com/maidsafe/sn_ffi_utils>
-
Unscored —
crate has been renamed to `safe-nd`
This crate has been renamed from `safe-nd` to `sn_data_types`. The new repository location is: <https://github.com/maidsafe/sn_data_types>
-
High 8.1
Undefined Behavior in bounded Crossbeam channel
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not act…
-
Unscored —
crate has been renamed to `cipher`
This crate has been renamed from `stream-cipher` to `cipher`. The new repository location is at: <https://github.com/RustCrypto/traits/tree/master/cipher>
-
Unscored —
crate has been renamed to `cipher`
This crate has been renamed from `block-cipher` to `cipher`. The new repository location is at: <https://github.com/RustCrypto/traits/tree/master/cipher>
-
Unscored —
Obsolete versions of the `rustsec` crate do not support the new V3 advisory format
If you are seeing this message, you are running an obsolete version of `cargo-audit` which does not support the new V3 advisory format. These versions are end-of-life. This advisory is a notice that that it will soon be unable to parse the advisory database. …
-
High 7.5
Array size is not checked in sized-chunks
An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with unit().
-
Critical 9.8
Access of Uninitialized Pointer in linked-hash-map
An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint.
-
Critical 9.8
Unaligned memory access in rand_core
An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
-
Critical 9.1
Out of bounds access in rgb
A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
-
High 7.5
Grin insufficient data validation
Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.
-
Unscored —
mach is unmaintained
Last release was almost 4 years ago. Maintainer(s) seem to be completely unreachable. ## Possible Alternative(s) These may or may not be suitable alternatives and have not been vetted in any way; - [mach2](https://crates.io/crates/mach2) - direct fork
-
High 8.6
Improper verification of signature threshold in tough
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures be…