# crates.io Advisories.

Every crates.io Advisory we hold (Rust), newest first.

## Records, newest first (an older page)

- [xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release](https://agentprime.io/advisories/GHSA-6g2r-675j-hx59.md)
  `GHSA-6g2r-675j-hx59` · crates.io `xxhash-rust`: affected `<0.8.16`, fixed in `0.8.16` · CVSS 2.3 Low · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [rmcp OAuth client fetches server-controlled resource_metadata URLs](https://agentprime.io/advisories/GHSA-c9xm-49cp-xcr9.md)
  `GHSA-c9xm-49cp-xcr9` · crates.io `rmcp`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 4.0, no score published · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [anymap2 is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0319.md)
  `RUSTSEC-2026-0319` · crates.io `anymap2`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 2 Oct 2026
- [Wasmtime wasi:http implementation panics with a zero timeout supplied](https://agentprime.io/advisories/GHSA-w4qr-p94g-mjhv.md)
  `GHSA-w4qr-p94g-mjhv`, `CVE-2026-115382`, `RUSTSEC-2026-0320` · crates.io `wasmtime-wasi-http`: affected `>=46.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 5.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-1284
- [Guest can panic host through filesystem timestamp before the epoch on wasip3](https://agentprime.io/advisories/GHSA-mr2v-56j5-cmfc.md)
  `GHSA-mr2v-56j5-cmfc`, `CVE-2026-115385`, `RUSTSEC-2026-0324` · crates.io `wasmtime-wasi`: affected `>=46.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-754
- [WASI preview 0 implementation of \`poll_oneoff\` circumvents fuel consumption](https://agentprime.io/advisories/GHSA-j366-h8gg-77pm.md)
  `GHSA-j366-h8gg-77pm`, `CVE-2026-115380`, `RUSTSEC-2026-0321` · crates.io `wasmtime-wasi`: affected `>=0.0.0-0, <36.0.17 || >=37.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `36.0.17`, `48.0.4`, `49.0.2` · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service
- [Rooting for GC values live across \`try_call\` may be missing, causing GC heap corruption](https://agentprime.io/advisories/GHSA-hw8m-q44c-ggrf.md)
  `GHSA-hw8m-q44c-ggrf`, `CVE-2026-115379`, `RUSTSEC-2026-0326` · crates.io `wasmtime`: affected `>=47.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Excessive allocated memory on the host when guests don't have stdio](https://agentprime.io/advisories/GHSA-gqmc-89g8-p25r.md)
  `GHSA-gqmc-89g8-p25r`, `CVE-2026-115381`, `RUSTSEC-2026-0322` · crates.io `wasmtime-wasi`: affected `>=0.0.0-0, <36.0.17 || >=37.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `36.0.17`, `48.0.4`, `49.0.2` · CVSS 5.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service
- [Mis-typed WebAssembly tag imports can lead to GC heap corruption](https://agentprime.io/advisories/GHSA-cfhf-m2cr-62wj.md)
  `GHSA-cfhf-m2cr-62wj`, `CVE-2026-115383`, `RUSTSEC-2026-0325` · crates.io `wasmtime`: affected `>=47.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 5.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-1287
- [fd_readdir copies uninitialized struct padding into guest memory](https://agentprime.io/advisories/GHSA-96f6-r43r-8c24.md)
  `GHSA-96f6-r43r-8c24`, `CVE-2026-115386`, `RUSTSEC-2026-0323` · crates.io `wasmtime-wasi`: affected `>=0.0.0-0, <36.0.17 || >=37.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `36.0.17`, `48.0.4`, `49.0.2` · CVSS 2.1 Low · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow](https://agentprime.io/advisories/GHSA-32h6-97mm-8q3c.md)
  `GHSA-32h6-97mm-8q3c`, `CVE-2026-115384`, `RUSTSEC-2026-0327` · crates.io `wasmtime`: affected `>=39.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-20
- [\`pin-utils\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0441.md)
  `RUSTSEC-2026-0441` · crates.io `pin-utils`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 1 Oct 2026
- [pageant: Out-of-bounds read / oversized allocation in \`pageant\` MemoryMap::read via a malicious Pageant agent (Windows)](https://agentprime.io/advisories/GHSA-g4mp-vgx3-xrvm.md)
  `GHSA-g4mp-vgx3-xrvm`, `CVE-2026-102820` · crates.io `pageant`: affected `<0.2.3`, fixed in `0.2.3` · CVSS 6.2 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Memory corruption, Denial of service
- [Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey](https://agentprime.io/advisories/GHSA-35g8-35p8-c8fw.md)
  `GHSA-35g8-35p8-c8fw`, `CVE-2026-102821` · crates.io `russh`: affected `<0.63.2`, fixed in `0.63.2` · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Denial of service
- [russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic](https://agentprime.io/advisories/GHSA-p8qx-h547-fjw9.md)
  `GHSA-p8qx-h547-fjw9`, `CVE-2026-102822` · crates.io `russh`: affected `<0.63.1`, fixed in `0.63.1` · CVSS 3.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-129
- [russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened](https://agentprime.io/advisories/GHSA-47hw-gvq5-r2gm.md)
  `GHSA-47hw-gvq5-r2gm`, `CVE-2026-102823` · crates.io `russh`: affected `<0.63.1`, fixed in `0.63.1` · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-20
- [Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange](https://agentprime.io/advisories/GHSA-w3jg-pjxf-73p4.md)
  `GHSA-w3jg-pjxf-73p4`, `CVE-2026-102824` · crates.io `russh`: affected `<0.63.0`, fixed in `0.63.0` · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS
- [Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path](https://agentprime.io/advisories/GHSA-g6xm-f9xp-qq35.md)
  `GHSA-g6xm-f9xp-qq35`, `CVE-2026-102825` · crates.io `russh`: affected `<0.62.6`, fixed in `0.62.6` · CVSS 3.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process](https://agentprime.io/advisories/GHSA-w5x2-6474-pqp4.md)
  `GHSA-w5x2-6474-pqp4`, `RUSTSEC-2026-0317` · crates.io `sheets-diff`: affected `>=0.0.0-0, <3.2.0`, fixed in `3.2.0` · CVSS 5.5 Medium · Not analysed yet · Published 29 Sept 2026
- [Sending custom to-device messages may panics](https://agentprime.io/advisories/GHSA-45pr-7vv7-f64m.md)
  `GHSA-45pr-7vv7-f64m`, `RUSTSEC-2026-0318` · crates.io `matrix-sdk-crypto`: affected `>=0.0.0-0, <0.19.0`, fixed in `0.19.0` · No CVSS score · Not analysed yet · Published 29 Sept 2026
- [Hybrid Encapsulation from Seed Panics on Short Seed](https://agentprime.io/advisories/RUSTSEC-2026-0330.md)
  `RUSTSEC-2026-0330` · crates.io `libcrux-kem`: affected `>=0.0.0-0, <0.0.10`, fixed in `0.0.10` · CVSS 4.0, no score published · Not analysed yet · Published 28 Sept 2026
- [Stack overflow on deeply nested LaTeX input](https://agentprime.io/advisories/RUSTSEC-2026-0311.md)
  `RUSTSEC-2026-0311` · crates.io `latex-rust`: affected `>=0.0.0-0, <1.0.5`, fixed in `1.0.5` · No CVSS score · Not analysed yet · Published 27 Sept 2026
- [\`basic-toml\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0374.md)
  `RUSTSEC-2026-0374` · crates.io `basic-toml`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 26 Sept 2026
- [Various panics, soundness and resource exhaustion issues](https://agentprime.io/advisories/RUSTSEC-2026-0310.md)
  `RUSTSEC-2026-0310` · crates.io `domain`: affected `>=0.0.0-0, <0.12.3`, fixed in `0.12.3` · No CVSS score · Not analysed yet · Published 25 Sept 2026
- [yara-x: Unvalidated deserialization in safe \`Rules::deserialize\` allows memory corruption and UB](https://agentprime.io/advisories/GHSA-2jx3-ff3v-j7jj.md)
  `GHSA-2jx3-ff3v-j7jj` · crates.io `yara-x`: affected `<1.19.0`, fixed in `1.19.0` · CVSS 4.0, no score published · Not analysed yet · Published 24 Sept 2026 · Tags: Insecure deserialization
- [Use-after-free in interned values and cached function results](https://agentprime.io/advisories/GHSA-xc3w-55vh-cw3w.md)
  `GHSA-xc3w-55vh-cw3w`, `RUSTSEC-2026-0308` · crates.io `salsa`: affected `>=0.23.0, <0.28.5`, fixed in `0.28.5` · No CVSS score · Not analysed yet · Published 24 Sept 2026
- [\`call_ref\` and exception \`catch\` can drop some fuel accounting, leading to exponential fuel amplification](https://agentprime.io/advisories/GHSA-m63x-6p34-q65x.md)
  `GHSA-m63x-6p34-q65x`, `CVE-2026-115390`, `RUSTSEC-2026-0315` · crates.io `wasmtime`: affected `>=47.0.0, <48.0.3 || >=49.0.0, <49.0.1`, fixed in `48.0.3`, `49.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Dynamic record lifting can allocate beyond the hostcall fuel limit](https://agentprime.io/advisories/GHSA-jqpg-j7w6-42pr.md)
  `GHSA-jqpg-j7w6-42pr`, `CVE-2026-115389`, `RUSTSEC-2026-0316` · crates.io `wasmtime`: affected `>=0.0.0-0, <36.0.16 || >=37.0.0, <48.0.3 || >=49.0.0, <49.0.1`, fixed in `36.0.16`, `48.0.3`, `49.0.1` · CVSS 1.0 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Guest can panic host through filesystem datetime overflow](https://agentprime.io/advisories/GHSA-j2g9-4prp-pf6h.md)
  `GHSA-j2g9-4prp-pf6h`, `CVE-2026-115387`, `RUSTSEC-2026-0314` · crates.io `wasmtime-wasi`: affected `>=0.0.0-0, <36.0.16 || >=37.0.0, <48.0.3 || >=49.0.0, <49.0.1`, fixed in `36.0.16`, `48.0.3`, `49.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption
- [Outgoing HTTP body write allows guest-driven host memory exhaustion](https://agentprime.io/advisories/GHSA-c9gc-w9vx-w86p.md)
  `GHSA-c9gc-w9vx-w86p`, `CVE-2026-115388`, `RUSTSEC-2026-0313` · crates.io `wasmtime-wasi-http`: affected `>=0.0.0-0, <36.0.16 || >=37.0.0, <48.0.3 || >=49.0.0, <49.0.1`, fixed in `36.0.16`, `48.0.3`, `49.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Denial of service
- [Excluded iPAddress name constraints with an all-zero mask are not applied](https://agentprime.io/advisories/GHSA-39mm-4q6x-3vrx.md)
  `GHSA-39mm-4q6x-3vrx`, `RUSTSEC-2026-0312` · crates.io `x509-validator`: affected `>=0.0.0-0, <0.3.1`, fixed in `0.3.1` · CVSS 7.4 High · Not analysed yet · Published 24 Sept 2026
- [Build environment compiled into the library and readable at runtime](https://agentprime.io/advisories/RUSTSEC-2026-0394.md)
  `RUSTSEC-2026-0394` · crates.io `rustpython-vm`: affected `>=0.3.0, <0.6.0`, fixed in `0.6.0` · No CVSS score · Not analysed yet · Published 23 Sept 2026
- [\`uncbv\`: archive extraction is vulnerable to path traversal (zip-slip)](https://agentprime.io/advisories/RUSTSEC-2026-0307.md)
  `RUSTSEC-2026-0307` · crates.io `uncbv`: affected `>=0.0.0-0, <0.3.1`, fixed in `0.3.1` · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026
- [Use-after-free when XML includes have duplicated entities](https://agentprime.io/advisories/GHSA-cpvr-w4j5-2mpg.md)
  `GHSA-cpvr-w4j5-2mpg`, `CVE-2026-96889`, `RUSTSEC-2026-0305` · crates.io `librsvg`: affected `>=0.0.0-0, <2.57.5 || >=2.57.90, <2.60.3 || >=2.61.0, <2.61.5 || >=2.61.90, <2.62.4 || >=2.62.90, <2.63.2`, fixed in `2.57.5`, `2.60.3`, `2.61.5`, `2.62.4`, `2.63.2` · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [microsandbox: Secret values exposed in world-readable process arguments](https://agentprime.io/advisories/GHSA-m8f5-rh7h-vgg3.md)
  `GHSA-m8f5-rh7h-vgg3`, `CVE-2026-61670` · crates.io `microsandbox`: affected `<0.5.10`, fixed in `0.5.10` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-214
- [\`stack-graphs\` is archived and unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0303.md)
  `RUSTSEC-2026-0303` · crates.io `stack-graphs`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 22 Sept 2026
- [\`stack-graphs\` C API exports are safe \`extern "C"\` functions](https://agentprime.io/advisories/RUSTSEC-2026-0302.md)
  `RUSTSEC-2026-0302` · crates.io `stack-graphs`: affected `>=0.0.3-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 22 Sept 2026
- [Double free in \`StackVec::retain\` when a predicate or element \`Drop\` panics](https://agentprime.io/advisories/RUSTSEC-2026-0301.md)
  `RUSTSEC-2026-0301` · crates.io `stack_collections`: affected `>=0.3.0, <0.3.3`, fixed in `0.3.3` · No CVSS score · Not analysed yet · Published 22 Sept 2026
- [\`owned-alloc\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0299.md)
  `RUSTSEC-2026-0299` · crates.io `owned-alloc`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 22 Sept 2026
- [\`unzip\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0296.md)
  `RUSTSEC-2026-0296` · crates.io `unzip`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 21 Sept 2026
- [Double free / use-after-free in \`Consumer::skip\` and \`Consumer::clear\` when an element's \`Drop\` panics](https://agentprime.io/advisories/RUSTSEC-2026-0293.md)
  `RUSTSEC-2026-0293` · crates.io `ringbuf`: affected `>=0.0.0-0, <0.5.2`, fixed in `0.5.2` · No CVSS score · Not analysed yet · Published 21 Sept 2026
- [Finished streaming calls keep reading a stalled request body indefinitely](https://agentprime.io/advisories/GHSA-jx5x-3mcr-qp8r.md)
  `GHSA-jx5x-3mcr-qp8r`, `RUSTSEC-2026-0304` · crates.io `connectrpc`: affected `>=0.2.0, <0.8.2 || >=0.9.0, <0.9.1`, fixed in `0.8.2`, `0.9.1` · CVSS 4.0, no score published · Not analysed yet · Published 21 Sept 2026
- [\`SinglyLinkedList::remove\` dereferences a null link](https://agentprime.io/advisories/RUSTSEC-2026-0309.md)
  `RUSTSEC-2026-0309` · crates.io `bun_collections`: affected `>=0.0.0-0, <0.2.1`, fixed in `0.2.1` · No CVSS score · Not analysed yet · Published 20 Sept 2026
- [\`hex_decode_unchecked\` AVX2 path reads past \`src\`](https://agentprime.io/advisories/RUSTSEC-2026-0306.md)
  `RUSTSEC-2026-0306` · crates.io `faster-hex`: affected `>=0.3.0, <0.10.1`, fixed in `0.10.1` · No CVSS score · Not analysed yet · Published 20 Sept 2026
- [\`decompress\`: tar-family extractors write archive entries without a path-traversal check (tar-slip)](https://agentprime.io/advisories/RUSTSEC-2026-0328.md)
  `RUSTSEC-2026-0328` · crates.io `decompress`: affected `>=0.0.0-0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 19 Sept 2026
- [Unsoundness in UTF-8 'String' trait](https://agentprime.io/advisories/GHSA-8mq4-3mwq-qvg6.md)
  `GHSA-8mq4-3mwq-qvg6`, `CVE-2026-92612`, `RUSTSEC-2026-0294` · crates.io `iceoryx2-bb-container`: affected `>=0.0.0-0, <0.10.0 || >=0.11.0-0`, fixed in `0.10.0` · CVSS 1.0 Low · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-749
- [RMCP: Custom HTTP headers leak to cross-origin redirect targets](https://agentprime.io/advisories/GHSA-9g45-5xwm-f3wc.md)
  `GHSA-9g45-5xwm-f3wc`, `CVE-2026-64684` · crates.io `rmcp`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure
- [pqc_kyber is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0289.md)
  `RUSTSEC-2026-0289` · crates.io `pqc_kyber`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 17 Sept 2026
- [cosmian_kyber is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0287.md)
  `RUSTSEC-2026-0287` · crates.io `cosmian_kyber`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 17 Sept 2026
- [RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service](https://agentprime.io/advisories/GHSA-9pj6-vhgr-3mwh.md)
  `GHSA-9pj6-vhgr-3mwh`, `CVE-2026-63128` · crates.io `rmcp`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service
- [RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery](https://agentprime.io/advisories/GHSA-33f5-2c5q-wgwj.md)
  `GHSA-33f5-2c5q-wgwj`, `CVE-2026-63127` · crates.io `rmcp`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-345
- [Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS](https://agentprime.io/advisories/GHSA-r6vc-97x9-63vv.md)
  `GHSA-r6vc-97x9-63vv`, `RUSTSEC-2026-0286` · crates.io `cryptoki`: affected `>=0.0.0-0, <0.10.1 || >=0.11.0, <0.11.1 || >=0.12.0, <0.12.1`, fixed in `0.10.1`, `0.11.1`, `0.12.1` · No CVSS score · Not analysed yet · Published 16 Sept 2026
- [libp2p-quic: Remote panic via certificate expiry race during QUIC handshake](https://agentprime.io/advisories/GHSA-5hq8-qhww-jm7q.md)
  `GHSA-5hq8-qhww-jm7q`, `CVE-2026-61544` · crates.io `libp2p-quic`: affected `<0.13.1`, fixed in `0.13.1` · CVSS 8.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-248
- [Outgoing datagram buffer accounting can panic the sender in quinn-proto](https://agentprime.io/advisories/GHSA-ppcp-v39w-8jq2.md)
  `GHSA-ppcp-v39w-8jq2`, `RUSTSEC-2026-0343` · crates.io `quinn-proto`: affected `>=0.11.17, <0.11.18`, fixed in `0.11.18` · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026
- [Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads](https://agentprime.io/advisories/GHSA-465w-v9q3-7j98.md)
  `GHSA-465w-v9q3-7j98`, `RUSTSEC-2026-0338` · crates.io `quinn-proto`: affected `>=0.7.0, <0.11.18`, fixed in `0.11.18` · No CVSS score · Not analysed yet · Published 14 Sept 2026
- [Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled](https://agentprime.io/advisories/GHSA-3g6h-r5qx-f6hq.md)
  `GHSA-3g6h-r5qx-f6hq`, `RUSTSEC-2026-0340` · crates.io `quinn-proto`: affected `>=0.11.0, <0.11.18`, fixed in `0.11.18` · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026
- [clear_on_drop is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0283.md)
  `RUSTSEC-2026-0283` · crates.io `clear_on_drop`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 13 Sept 2026
- [Use-after-free when a future's \`Drop\` panics while the container is dropped](https://agentprime.io/advisories/GHSA-8gw6-724c-9h38.md)
  `GHSA-8gw6-724c-9h38`, `RUSTSEC-2026-0298` · crates.io `unicycle`: affected `>=0.0.0-0, <0.10.3`, fixed in `0.10.3` · No CVSS score · Not analysed yet · Published 12 Sept 2026
- [mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS](https://agentprime.io/advisories/GHSA-m3wp-48jr-vr4g.md)
  `GHSA-m3wp-48jr-vr4g` · crates.io `mistralrs-server-core`: affected `<0.8.18`, fixed in `0.8.18` · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Denial of service
- [mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url](https://agentprime.io/advisories/GHSA-wfgq-w7cq-qj7j.md)
  `GHSA-wfgq-w7cq-qj7j` · crates.io `mistralrs-server-core`: affected `<0.8.18`, fixed in `0.8.18` · CVSS 7.2 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal, Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/ecosystem/crates.md>
Older: <https://agentprime.io/advisories/ecosystem/crates.md?cursor=WyIyMDI2LTA5LTEwVDIxOjU0OjE0LjAwMDAwMFoiLCJHSFNBLXdmZ3EtdzdjcS1xajdqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=crates.io&cursor=WyIyMDI2LTEwLTAyVDIyOjQ0OjUyLjAwMDAwMFoiLCJHSFNBLThmZnIteGd3Zi14ajU2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/crates/?cursor=WyIyMDI2LTEwLTAyVDIyOjQ0OjUyLjAwMDAwMFoiLCJHSFNBLThmZnIteGd3Zi14ajU2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.