# crates.io Advisories.

Every crates.io Advisory we hold (Rust), newest first.

## Records, newest first (an older page)

- [gix-sec safe.directory protections absent for elevated administrators](https://agentprime.io/advisories/GHSA-7rhf-42qf-vrvc.md)
  `GHSA-7rhf-42qf-vrvc`, `CVE-2025-24890` · crates.io `gix-sec`: affected `<0.13.3`, fixed in `0.13.3` · CVSS 6.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-283
- [\`unzip\`: archive extraction is vulnerable to path traversal (zip-slip)](https://agentprime.io/advisories/RUSTSEC-2026-0297.md)
  `RUSTSEC-2026-0297` · crates.io `unzip`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 9 Sept 2026
- [Double free in \`OwnedAlloc::drop_in_place\` when the contained value's \`Drop\` panics](https://agentprime.io/advisories/RUSTSEC-2026-0291.md)
  `RUSTSEC-2026-0291` · crates.io `owned-alloc`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 9 Sept 2026
- [Double free in \`AlignedBox<\[T\]>::realloc_with_default\` when an element's \`Drop\` panics](https://agentprime.io/advisories/RUSTSEC-2026-0282.md)
  `RUSTSEC-2026-0282` · crates.io `aligned_box`: affected `>=0.0.0-0, <0.3.1`, fixed in `0.3.1` · No CVSS score · Not analysed yet · Published 9 Sept 2026
- [SWC HTML minifier may allow script element breakout when minifying embedded JSON](https://agentprime.io/advisories/GHSA-5qr2-v392-m9g8.md)
  `GHSA-5qr2-v392-m9g8`, `CVE-2026-72925` · crates.io `swc_html_minifier` and 1 more: affected `<59.0.0`, fixed in `59.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [\`WaveFormat::parse\` reads past the end of a \`&WAVEFORMATEX\`](https://agentprime.io/advisories/RUSTSEC-2026-0332.md)
  `RUSTSEC-2026-0332` · crates.io `wasapi`: affected `>=0.20.0, <0.25.0`, fixed in `0.25.0` · No CVSS score · Not analysed yet · Published 8 Sept 2026
- [\`greentic-setup\` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0281.md)
  `RUSTSEC-2026-0281` · crates.io `greentic-setup`: affected `>=1.3.1-dev.34027618345, <1.3.1-dev.34027618345.0`, fixed in `1.3.1-dev.34027618345.0` · No CVSS score · Not analysed yet · Published 7 Sept 2026
- [\`greentic-setup-dev\` 1.3.34027618345 was removed from crates.io due to containing malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0280.md)
  `RUSTSEC-2026-0280` · crates.io `greentic-setup-dev`: affected `>=1.3.34027618345, <1.3.34027618346-0`, fixed in `1.3.34027618346-0` · No CVSS score · Not analysed yet · Published 7 Sept 2026
- [SurrealDB: Writes in a PERMISSIONS clause bypass table permissions](https://agentprime.io/advisories/GHSA-66r2-5gwj-gxm2.md)
  `GHSA-66r2-5gwj-gxm2`, `CVE-2026-63733` · crates.io `surrealdb-core`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path](https://agentprime.io/advisories/GHSA-848m-r628-vrxw.md)
  `GHSA-848m-r628-vrxw`, `CVE-2026-63735` · crates.io `surrealdb`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 8.6 High · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [CodeWhale: Project config \`allow_shell\` override enables arbitrary shell command execution via cloned repository](https://agentprime.io/advisories/GHSA-gx45-xrj5-g6c4.md)
  `GHSA-gx45-xrj5-g6c4`, `CVE-2026-75911` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)](https://agentprime.io/advisories/GHSA-wrj3-vj8c-784f.md)
  `GHSA-wrj3-vj8c-784f`, `CVE-2026-75858` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection, Broken access control
- [CodeWhale: Argument Injection in \`git_blame\` Tool Allows Arbitrary File Read Without Approval](https://agentprime.io/advisories/GHSA-c6mw-8xh8-gpq6.md)
  `GHSA-c6mw-8xh8-gpq6`, `CVE-2026-75912` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.3 High · Not analysed yet · Published 4 Sept 2026 · Tags: Command injection, Information disclosure
- [CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning](https://agentprime.io/advisories/GHSA-6v2g-fpxh-pmmh.md)
  `GHSA-6v2g-fpxh-pmmh`, `CVE-2026-75856` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [CodeWhale: js_execution leaks parent environment to model context via missing env scrub](https://agentprime.io/advisories/GHSA-h539-c7r8-3xq4.md)
  `GHSA-h539-c7r8-3xq4`, `CVE-2026-75915` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Information disclosure, CWE-526
- [CodeWhale: Argument Injection in \`git_show\` Tool Allows Arbitrary File Write Without Approval](https://agentprime.io/advisories/GHSA-7j5w-7r7x-9v27.md)
  `GHSA-7j5w-7r7x-9v27`, `CVE-2026-75913` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal, Command injection
- [CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)](https://agentprime.io/advisories/GHSA-g29h-pfmp-qp9r.md)
  `GHSA-g29h-pfmp-qp9r`, `CVE-2026-75857` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 7.3 High · Not analysed yet · Published 4 Sept 2026 · Tags: Privilege escalation
- [CodeWhale: Project config \`instructions\` override enables arbitrary file read into AI system prompt via cloned repository](https://agentprime.io/advisories/GHSA-62f5-cp2p-vq95.md)
  `GHSA-62f5-cp2p-vq95`, `CVE-2026-75859` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal, Information disclosure
- [CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes](https://agentprime.io/advisories/GHSA-w7wx-5q49-r59w.md)
  `GHSA-w7wx-5q49-r59w`, `CVE-2026-75914` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal
- [SurrealDB allows bypass of deny-net flags via DNS resolution](https://agentprime.io/advisories/GHSA-m3c3-78fh-w3w7.md)
  `GHSA-m3c3-78fh-w3w7`, `CVE-2025-71390` · crates.io `SurrealDB`: affected `>=2.1.0, <2.1.8 || >=2.2.0, <2.2.6 || >=2.3.0, <2.3.6 || >=3.0.0-alpha.1, <3.0.0-alpha.7`, fixed in `2.1.8`, `2.2.6`, `2.3.6`, `3.0.0-alpha.7` · CVSS 5.8 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control, CWE-923
- [Double free / use-after-free in \`Chunk\` and \`InlineArray\` removal methods when an element's \`Drop\` panics](https://agentprime.io/advisories/RUSTSEC-2026-0292.md)
  `RUSTSEC-2026-0292` · crates.io `imbl-sized-chunks`: affected `>=0.0.0-0, <0.2.0`, fixed in `0.2.0` · No CVSS score · Not analysed yet · Published 4 Sept 2026
- [Hurl: Cookies in Cookies section leak when redirecting to a different host](https://agentprime.io/advisories/GHSA-7w2g-9mf9-324m.md)
  `GHSA-7w2g-9mf9-324m`, `CVE-2026-63481` · crates.io `hurl`: affected `<=8.0.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Information disclosure
- [Use-after-free in \`clear\` and \`retain\` when an element's \`Drop\` panics](https://agentprime.io/advisories/GHSA-x6j6-3ffp-qrfr.md)
  `GHSA-x6j6-3ffp-qrfr`, `RUSTSEC-2026-0300` · crates.io `skiplist`: affected `>=0.0.0-0, <1.1.1`, fixed in `1.1.1` · No CVSS score · Not analysed yet · Published 2 Sept 2026
- [\`zbus_polkit\`: authorization bypass via PID reuse](https://agentprime.io/advisories/RUSTSEC-2026-0278.md)
  `RUSTSEC-2026-0278`, `CVE-2026-78422` · crates.io `zbus_polkit`: affected `>=0.0.0-0, <5.1.0`, fixed in `5.1.0` · CVSS 7.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: Race condition, CWE-686
- [Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation](https://agentprime.io/advisories/GHSA-f9qc-qg88-7pq5.md)
  `GHSA-f9qc-qg88-7pq5`, `CVE-2026-55407` · crates.io `buffa`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 6.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref](https://agentprime.io/advisories/GHSA-9pwq-gcrx-wghh.md)
  `GHSA-9pwq-gcrx-wghh`, `CVE-2026-55406` · crates.io `buffa`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Information disclosure, Memory corruption
- [datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS](https://agentprime.io/advisories/GHSA-gpwf-4h98-v82q.md)
  `GHSA-gpwf-4h98-v82q`, `CVE-2026-54788` · crates.io `datadog-opentelemetry`: affected `>=0.1.0, <0.3.3`, fixed in `0.3.3` · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)](https://agentprime.io/advisories/GHSA-2vh6-hw4j-32ww.md)
  `GHSA-2vh6-hw4j-32ww`, `CVE-2026-82250` · crates.io `gix-packetline`: affected `<0.21.5`, fixed in `0.21.5` · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Memory corruption
- [Panic-safety unsoundness in \`Stack::pop\`, \`Fifo::pop_front\` and \`Value::replace_stable\` (use-after-free / double-free)](https://agentprime.io/advisories/RUSTSEC-2026-0272.md)
  `RUSTSEC-2026-0272` · crates.io `stack_dst`: affected `>=0.0.0-0, <0.8.2`, fixed in `0.8.2` · No CVSS score · Not analysed yet · Published 27 Aug 2026
- [Double free in \`Map::into_iter\` and an uninitialized \`Arc\` in \`SharedIncin::clear\`](https://agentprime.io/advisories/RUSTSEC-2026-0284.md)
  `RUSTSEC-2026-0284` · crates.io `lockfree`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 26 Aug 2026
- [Path traversal in apimock's file-serving fallback](https://agentprime.io/advisories/GHSA-72g6-wgrg-vhm7.md)
  `GHSA-72g6-wgrg-vhm7`, `RUSTSEC-2026-0276`, `RUSTSEC-2026-0277` · crates.io `apimock`: affected `>=0.0.0-0, <4.8.1 || >=5.0.0, <5.0.0`, fixed in `4.8.1`, `5.0.0` · CVSS 4.0, no score published · Not analysed yet · Published 26 Aug 2026
- [mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)](https://agentprime.io/advisories/GHSA-p7x2-g5cq-fhmq.md)
  `GHSA-p7x2-g5cq-fhmq`, `CVE-2026-55663` · crates.io `mediasoup` and 1 more: affected `>=0.22.0, <0.22.5`, fixed in `0.22.5` · CVSS 5.6 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-345
- [vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths](https://agentprime.io/advisories/GHSA-fx4f-mhw4-qm7j.md)
  `GHSA-fx4f-mhw4-qm7j`, `RUSTSEC-2026-0181` · crates.io `vibeio-http`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service
- [tokio-postgres: Panic on a \`DataRow\` with fewer fields than columns allows denial of service](https://agentprime.io/advisories/GHSA-3gjw-f78c-vvpw.md)
  `GHSA-3gjw-f78c-vvpw`, `RUSTSEC-2026-0178` · crates.io `tokio-postgres`: affected `>=0.4.0, <0.7.18`, fixed in `0.7.18` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption
- [postgres-protocol: Panic decoding a malformed \`hstore\` value allows denial of service](https://agentprime.io/advisories/GHSA-rgqc-3x5p-6gwg.md)
  `GHSA-rgqc-3x5p-6gwg`, `RUSTSEC-2026-0180` · crates.io `postgres-protocol`: affected `<0.6.12`, fixed in `0.6.12` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-20, CWE-248
- [postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service](https://agentprime.io/advisories/GHSA-5x78-73v4-xg6w.md)
  `GHSA-5x78-73v4-xg6w`, `RUSTSEC-2026-0179` · crates.io `postgres-protocol`: affected `>=0.3.0, <0.6.12`, fixed in `0.6.12` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026 · Tags: Denial of service
- [Rejected authentication challenges can poison the Key Vault scope cache](https://agentprime.io/advisories/RUSTSEC-2026-0439.md)
  `RUSTSEC-2026-0439` · crates.io `azure_security_keyvault_keys`: affected `>=0.10.0, <1.0.1`, fixed in `1.0.1` · No CVSS score · Not analysed yet · Published 24 Aug 2026
- [Rejected authentication challenges can poison the Key Vault scope cache](https://agentprime.io/advisories/RUSTSEC-2026-0438.md)
  `RUSTSEC-2026-0438` · crates.io `azure_security_keyvault_secrets`: affected `>=0.10.0, <1.0.1`, fixed in `1.0.1` · No CVSS score · Not analysed yet · Published 24 Aug 2026
- [Rejected authentication challenges can poison the Key Vault scope cache](https://agentprime.io/advisories/RUSTSEC-2026-0437.md)
  `RUSTSEC-2026-0437` · crates.io `azure_security_keyvault_certificates`: affected `>=0.9.0, <1.0.1 || >=1.1.0-beta.0, <1.1.0-beta.2`, fixed in `1.0.1`, `1.1.0-beta.2` · No CVSS score · Not analysed yet · Published 24 Aug 2026
- [Panic on Decoding Short Hybrid Keys](https://agentprime.io/advisories/RUSTSEC-2026-0331.md)
  `RUSTSEC-2026-0331` · crates.io `libcrux-kem`: affected `>=0.0.0-0, <0.0.10`, fixed in `0.0.10` · CVSS 4.0, no score published · Not analysed yet · Published 24 Aug 2026
- [Panic-safety unsoundness in \`BitVecCore::clear\` (double-free / use-after-free)](https://agentprime.io/advisories/GHSA-mr2v-63pc-gmr4.md)
  `GHSA-mr2v-63pc-gmr4`, `RUSTSEC-2026-0267` · crates.io `stable-vec`: affected `>=0.0.0-0, <0.4.3`, fixed in `0.4.3` · No CVSS score · Not analysed yet · Published 24 Aug 2026
- [Zoo Design Studio: Memory-corruption in memory handling of lib-kcl](https://agentprime.io/advisories/GHSA-mc9m-6fm9-pghc.md)
  `GHSA-mc9m-6fm9-pghc` · crates.io `kcl-lib` and 1 more: affected `<0.2.153`, fixed in `0.2.153` · CVSS 4.0, no score published · Not analysed yet · Published 20 Aug 2026 · Tags: Race condition, Memory corruption
- [Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service](https://agentprime.io/advisories/GHSA-jgvr-6x5w-hx5w.md)
  `GHSA-jgvr-6x5w-hx5w` · crates.io `kcl-lib` and 1 more: affected `<0.3.129`, fixed in `0.3.129` · CVSS 4.0, no score published · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service
- [\`internment\` 0.8.7 was removed from crates.io due to a malicious dependency](https://agentprime.io/advisories/RUSTSEC-2026-0266.md)
  `RUSTSEC-2026-0266` · crates.io `internment`: affected `>=0.8.7-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`proc-macro1\` was removed from crates.io due to malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0265.md)
  `RUSTSEC-2026-0265` · crates.io `proc-macro1`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`proc-macro-en\` was removed from crates.io due to malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0264.md)
  `RUSTSEC-2026-0264` · crates.io `proc-macro-en`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`tinymember\` was removed from crates.io due to affiliation with malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0263.md)
  `RUSTSEC-2026-0263` · crates.io `tinymember`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`append-only-vec\` 0.1.9 was removed from crates.io due to a malicious dependency](https://agentprime.io/advisories/RUSTSEC-2026-0262.md)
  `RUSTSEC-2026-0262` · crates.io `append-only-vec`: affected `>=0.1.9, <0.1.10-0`, fixed in `0.1.10-0` · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`aronenao\` was removed from crates.io due to malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0261.md)
  `RUSTSEC-2026-0261` · crates.io `aronenao`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`arrayref\` 0.3.10 was removed from crates.io due to a malicious dependency](https://agentprime.io/advisories/RUSTSEC-2026-0260.md)
  `RUSTSEC-2026-0260` · crates.io `arrayref`: affected `>=0.3.10-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [\`arone\` was removed from crates.io due to malicious code](https://agentprime.io/advisories/RUSTSEC-2026-0259.md)
  `RUSTSEC-2026-0259` · crates.io `arone`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 20 Aug 2026
- [Guest controlled-size host heap allocation through WASIp3 streams](https://agentprime.io/advisories/GHSA-x84v-gj2h-g759.md)
  `GHSA-x84v-gj2h-g759`, `CVE-2026-115391`, `RUSTSEC-2026-0268` · crates.io `wasmtime`: affected `>=46.0.0, <46.0.3 || >=47.0.0, <47.0.4`, fixed in `46.0.3`, `47.0.4` · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service
- [Filesystem sandbox escape when paths or symlinks contain trailing slashes](https://agentprime.io/advisories/GHSA-vqjp-4c8c-hfgg.md)
  `GHSA-vqjp-4c8c-hfgg`, `CVE-2026-115392`, `RUSTSEC-2026-0269` · crates.io `wasmtime`: affected `>=0.0.0-0, <24.0.13 || >=25.0.0, <36.0.14 || >=37.0.0, <46.0.3 || >=47.0.0, <47.0.4`, fixed in `24.0.13`, `36.0.14`, `46.0.3`, `47.0.4` · CVSS 8.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-61
- [block_buffer: panic corrupts inline buffer position](https://agentprime.io/advisories/GHSA-qwgh-2vcv-g2f7.md)
  `GHSA-qwgh-2vcv-g2f7` · crates.io `block_buffer`: affected `>=0.11.0, <0.12.1`, fixed in `0.12.1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Aug 2026 · Tags: Memory corruption
- [Triton VM Soundness Vulnerability due to Missing Constraint](https://agentprime.io/advisories/GHSA-vjf8-9fx6-mv6x.md)
  `GHSA-vjf8-9fx6-mv6x`, `RUSTSEC-2021-0156` · crates.io `triton-vm`: affected `>=0.42.0-alpha.4, <4.0.0`, fixed in `4.0.0` · CVSS 4.0, no score published · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-345
- [FTP command injection via CRLF in control channel arguments](https://agentprime.io/advisories/GHSA-8mhj-xm4h-m5m6.md)
  `GHSA-8mhj-xm4h-m5m6`, `RUSTSEC-2026-0271` · crates.io `suppaftp`: affected `>=0.0.0-0, <10.0.2`, fixed in `10.0.2` · No CVSS score · Not analysed yet · Published 18 Aug 2026
- [Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed](https://agentprime.io/advisories/GHSA-qfwj-vfxf-92j2.md)
  `GHSA-qfwj-vfxf-92j2`, `RUSTSEC-2026-0341` · crates.io `quinn-proto`: affected `>=0.11.15, <0.11.17`, fixed in `0.11.17` · CVSS 7.5 High · Not analysed yet · Published 17 Aug 2026
- [h2 unbounded empty DATA frames](https://agentprime.io/advisories/GHSA-q83h-524g-xf6h.md)
  `GHSA-q83h-524g-xf6h`, `RUSTSEC-2026-0258` · crates.io `h2`: affected `>=0.0.0-0, <0.4.16`, fixed in `0.4.16` · No CVSS score · Not analysed yet · Published 17 Aug 2026
- [Unbounded growth of pending connection ID retirements in quinn-proto](https://agentprime.io/advisories/GHSA-hmxj-32vh-65vr.md)
  `GHSA-hmxj-32vh-65vr`, `RUSTSEC-2026-0339` · crates.io `quinn-proto`: affected `>=0.6.0, <0.11.17`, fixed in `0.11.17` · No CVSS score · Not analysed yet · Published 17 Aug 2026
- [Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto](https://agentprime.io/advisories/GHSA-2hv7-gw8g-gpq5.md)
  `GHSA-2hv7-gw8g-gpq5`, `RUSTSEC-2026-0342` · crates.io `quinn-proto`: affected `>=0.5.0, <0.11.17`, fixed in `0.11.17` · No CVSS score · Not analysed yet · Published 17 Aug 2026

Newest: <https://agentprime.io/advisories/ecosystem/crates.md>
Older: <https://agentprime.io/advisories/ecosystem/crates.md?cursor=WyIyMDI2LTA4LTE3VDEyOjAwOjAwLjAwMDAwMFoiLCJHSFNBLTJodjctZ3c4Zy1ncHE1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=crates.io&cursor=WyIyMDI2LTA5LTEwVDIxOjU0OjE0LjAwMDAwMFoiLCJHSFNBLXdmZ3EtdzdjcS1xajdqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/crates/?cursor=WyIyMDI2LTA5LTEwVDIxOjU0OjE0LjAwMDAwMFoiLCJHSFNBLXdmZ3EtdzdjcS1xajdqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.