Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
High 7.5
Improper Synchronization and Race Condition in vm-memory
rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
-
Unscored —
crate has been renamed to `block-cipher`
This crate has been renamed from `block-cipher-trait` to `block-cipher`. The new repository location is at: <https://github.com/RustCrypto/traits/tree/master/block-cipher>
-
Medium 5.3
Grin allows attackers to adversely affect availability of data on a Mimblewimble blockchain
Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.
-
Unscored —
stdweb is unmaintained
The author of the `stdweb` crate is unresponsive. Maintained alternatives: - [`wasm-bindgen`](https://github.com/rustwasm/wasm-bindgen) - [`js-sys`](https://github.com/rustwasm/wasm-bindgen/tree/master/crates/js-sys) - [`web-sys`](https://github.com/rustwasm/…
-
Unscored —
`net2` crate has been deprecated; use `socket2` instead
The [`net2`](https://crates.io/crates/net2) crate has been deprecated and users are encouraged to considered [`socket2`](https://crates.io/crates/socket2) instead.
-
High 7.5
Segmentation fault in SSL_check_chain
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an i…
-
Unscored —
`stb_truetype` crate has been deprecated; use `ttf-parser` instead
This crate was maintained for use in rusttype which has switched to use [ttf-parser](https://crates.io/crates/ttf-parser)
-
Unscored —
tiberius is unmaintained
The author of `tiberius` has archived the GitHub repository and left the following note: > I do not have the time to overhaul the library and do not intend to further > maintain the 0.3 version relying on the old futures ecosystem. Suggested alternatives are:…
-
Unscored —
rulinalg is unmaintained, use nalgebra instead
The `rulinalg` crate is no longer maintained, use [nalgebra](https://crates.io/crates/nalgebra) instead.
-
Unscored —
slice-deque is unmaintained
The author of the `slice-deque` crate is unresponsive and is not receiving security patches. Maintained alternatives: - [`slice-ring-buffer`](https://crates.io/crates/slice-ring-buffer)
-
Unscored —
lzw is unmaintained
The author of the `lzw` crate is unresponsive. Maintained alternatives: - [`weezl`](https://crates.io/crates/weezl)
-
Unscored —
multi_mut is Unmaintained
Last release was about 6 years ago. There is an outstanding [soundness issue](https://github.com/golddranks/multi_mut/issues/1). The maintainer has not responded for two years to the existing soundness issue. Rust compiler has enabled errors relating to LLVM …
-
Unscored —
`tokio-proto` is deprecated/unmaintained
The [`tokio-proto`](https://crates.io/crates/tokio-proto) crate has been deprecated, and [its GitHub repository](https://github.com/tokio-rs/tokio-proto) has been archived. Users may be interested in [`tokio-tower`](https://crates.io/crates/tokio-tower) inste…
-
Medium 5.9
Observable Discrepancy in libsecp256k1-rs
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
-
High 7.5
Grin Insufficient Validation
Grin through 2.1.1 has Insufficient Validation.
-
Unscored —
rust_sodium is unmaintained; switch to a modern alternative
The `rust_sodium` crate is no longer maintained by its current owner, who advise in the repository readme that they are looking for someone else to take ownership of it. We recommend you switch to an alternative crate such as: - [`sodiumoxide`](https://crates…
-
Unscored —
crust repo has been archived; use libp2p instead
** The `crust` crate repo was archived with no warning or explanation.** Given that it was archived with no warning or successor, there's not an official replacement but [`rust-libp2p`](https://github.com/libp2p/rust-libp2p) looks like it's got a similar feat…
-
Unscored —
Test advisory with associated example crate
This is a test advisory useful for verifying RustSec tooling and vulnerability detection pipelines are working correctly. Aside from the fact that it is filed against an example crate, it is otherwise considered by the Advisory Database itself to be a normal …
-
Medium 4.6
Cargo prior to Rust 1.26.0 may download the wrong dependency
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is u…
-
High 7.5
Use after free in string-interner
An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.
-
Critical 9.8
Use after free in portaudio-rs
An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
-
Critical 9.8
Double free in linea
An issue was discovered in the linea crate through 0.9.4 for Rust. There is double free in the Matrix::zip_elements method.
-
High 7.5
Uninitialized memory use in generator
An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
-
Critical 9.8
Algorithms compute incorrect results in blake2
An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
-
Critical 9.8
Improper Input Validation in renderdoc
An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
-
High 7.5
Improper Input Validation in once_cell
An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.
-
Critical 9.8
Out of bounds access in compact_arena
An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.
-
Critical 9.8
Use after free in image
An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution.
-
High 7.5
Wrong memory orderings violates mutual exclusion in spin
An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
-
Critical 9.8
Use-after-free in chttp
An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
-
Medium 5.3
Improper Certificate Validation in security-framework
An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
-
High 7.5
Integer underflow in untrusted
An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
-
High 7.5
Improper Input Validation in cookie
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
-
Critical 9.8
Memory corruption slice-deque
An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.
-
Critical 9.8
Double free in crossbeam
An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.
-
Critical 9.8
Use after free in openssl
An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
-
Critical 9.8
Potential memory corruption in arrayfire
An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption.
-
High 7.5
Uncontrolled recursion in ammonia
An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
-
Critical 9.8
Out of bounds write in slice-deque
An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.
-
High 7.5
Uncontrolled memory consumption in protobuf
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.