Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
2,074 results · Feed
-
High 7.5
Failure to properly verify ed25519 signatures in libp2p-core
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.
-
High 7.5
Format string vulnerabilities in pancurses
An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.
-
High 7.5
Mishandling of format strings in ncurses
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled.
-
High 7.5
Memory exhaustion in asn1_der
An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field.
-
Critical 9.8
Use after free in libflate
An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
-
Critical 9.8
Double free in smallvec
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.
-
Critical 9.8
Memory corruption in smallvec
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
-
High 7.5
Exposure of uninitialized memory in memoffset
An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
-
High 7.5
Out of bounds read in simd-json
An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page boundary.
-
Critical 9.8
Heap overflow or corruption in safe-transmute
An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption.
-
High 7.5
Flaw in streaming state in orion
An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.
-
Critical 9.8
Double free in smallvec
An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.
-
High 7.5
Arbitrary file overwrite in tar-rs
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
-
High 7.5
Uncontrolled recursion in trust-dns-proto
An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.
-
High 7.5
Uncontrolled recursion in rust-yaml
An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.
-
Medium 6.5
Uninitialized memory exposure in claxon
An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.
-
Medium 5.3
Headers containing newline characters can split messages in hyper
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
-
Medium 5.9
Source code is downloaded over cleartext HTTP in portaudio
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
-
Medium 4.8
HTTPS MitM vulnerability due to lack of hostname verification
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
-
High 8.1
Improper Certificate Validation in openssl
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
-
Unscored —
`boxfnonce` obsolete with release of Rust 1.35.0
[This](https://github.com/stbuehler/rust-boxfnonce/commit/058ac7e1a7d732076da9d8a37baa66bcb67758d8) commit marks the `boxfnonce` crate as obsolete and the GitHub repo has since been archived. The functionality of `boxfnonce` has been added to Rust since 1.35.…
-
Unscored —
term is looking for a new maintainer
The author of the `term` crate does not have time to maintain it and is looking for a new maintainer. Some maintained alternatives you can potentially switch to instead, depending on your needs: - [`crossterm`](https://github.com/crossterm-rs/crossterm) - [`t…
-
Unscored —
chan is end-of-life; use crossbeam-channel instead
**`chan` has reached its end-of-life and is now deprecated.** The intended successor of this crate is [`crossbeam-channel`](https://github.com/crossbeam-rs/crossbeam/tree/master/crossbeam-channel). Its API is strikingly similar, but comes with a much better `…
-
Unscored —
quickersort is deprecated and unmaintained
The author of the `quickersort` crate has deprecated it and does not recommend using it anymore. Everything in it has been incorporated into [std::sort_unstable] in the standard library as of Rust 1.20. [std::sort_unstable]: https://doc.rust-lang.org/stable/s…
-
Unscored —
`tempdir` crate has been deprecated; use `tempfile` instead
The [`tempdir`](https://crates.io/crates/tempdir) crate has been deprecated and the functionality is merged into [`tempfile`](https://crates.io/crates/tempfile).
-
Critical 9.8
Integer overflow in base64
rust-base64 version <= 0.5.1 is vulnerable to a buffer overflow when calculating the size of a buffer to use when encoding base64 using the 'encode_config_buf' and 'encode_config' functions
-
Medium 6.5
scalarmult() vulnerable to degenerate public keys
sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys
-
Unscored —
`serial` crate is unmaintained
The [`serial`](https://crates.io/crates/serial) crate is no longer maintained. Last release was on 2017-07-02. ## Possible alternatives Consider using an alternative, for instance the blocking librarys: - [serial2](https://crates.io/crates/serial2) - [serialp…
-
Unscored —
lz4-compress is unmaintained
[According to the developers](https://gitlab.redox-os.org/redox-os/tfs/issues/89) this crate is no longer maintained. The suggested alternative is [`lz4-compression`](https://crates.io/crates/lz4-compression), a maintained fork of `lz4-compress`. See also [lz…
-
Unscored —
`cassandra` crate is unmaintained; use `cassandra-cpp` instead
The `cassandra` crate has not seen a release since December 2016, and its author is unresponsive. The `cassandra-cpp` crate is a maintained fork: https://github.com/Metaswitch/cassandra-rs
-
Unscored —
jwt appears to be unmaintained
The `jwt` crate appears to be unmaintained. Alternatives: - [jsonwebtoken](https://crates.io/crates/jsonwebtoken/) - [jwt-simple](https://crates.io/crates/jwt-simple)
-
Unscored —
libusb is unmaintained; use rusb instead
The `libusb` crate has not seen a release since September 2016, and its author is unresponsive. The `rusb` crate is a maintained fork: https://github.com/a1ien/rusb
-
Unscored —
rust-crypto is unmaintained; switch to a modern alternative
The `rust-crypto` crate has not seen a release or GitHub commit since 2016, and its author is unresponsive. *NOTE: The (old) `rust-crypto` crate (with hyphen) should not be confused with similarly named (new) [RustCrypto GitHub Org] (without hyphen). The GitH…
-
High 7.5
librsvg DoS via Cyclic References
librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.