Skip to content
OpenAdvisories

Package · crates.io

rustls-ffi

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Unscored —
    GHSA-rc3f-4j82-cmrg

    Use-after-free of caller-owned server name in client connection constructors

    In rustls-ffi 0.12.0 through 0.15.6, `rustls_client_connection_new()` and `rustls_client_connection_new_alpn()` retained a reference to the caller's `server_name` buffer after returning, rather than copying it. The API documentation did not require the buffer…

    rustls-ffi crates.io