crates.io Advisories.

pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery

>=0.0.0-0 · no fixed version yet

cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery

>=0.0.0-0 · no fixed version yet

Legacy `azure_core` writes the `authorization` header value to logs

>=0.0.0-0, <0.2.0 || >=0.2.1-0, <0.22.0 · fixed in 0.2.0, 0.22.0

s2n-quic has excessive memory allocation

• Denial of service

<1.82.0 · fixed in 1.82.0

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

• Broken access control

<3.1.4 · fixed in 3.1.4

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

>=0.0.6, <0.0.11 · fixed in 0.0.11

nimiq-blockchain: Validity store off by one error

• Authentication bypass
• CWE-193

<1.5.1 · fixed in 1.5.1

Memory corruption bug on `ApplyResult` type

>=0.0.0-0, <0.21.0 · fixed in 0.21.0

`sp-sized-chunks` is unmaintained

>=0.0.0-0 · no fixed version yet

Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)

>=0.0.0-0, <2.0.1 · fixed in 2.0.1

Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)

>=0.0.0-0 · no fixed version yet

Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)

>=0.0.0-0 · no fixed version yet

Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)

>=0.0.0-0, <4.0.0 · fixed in 4.0.0

Low-level GCM ignores the operation nonce

>=0.0.0-0, <2.0.0 · fixed in 2.0.0

Streaming AEAD does not authenticate stream structure

>=0.0.0-0, <2.0.0 · fixed in 2.0.0

Ed25519 identity public keys permit universal signature forgery

>=0.0.0-0, <2.0.0 · fixed in 2.0.0

Safe ErrorRegistry APIs can cause undefined behavior

>=0.0.0-0, <2.0.0 · fixed in 2.0.0

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

>=0.1.5, <0.3.1 || >=0.4.0, <0.4.1 · fixed in 0.3.1, 0.4.1

`sevenz-rust` is unmaintained

>=0.0.0-0 · no fixed version yet

Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

>=0.0.0-0 · no fixed version yet

`setlocale` and `TextDomain::init` are unsound as they access environment with no synchronization

>=0.0.0-0, <0.8.0 · fixed in 0.8.0

A `BigInt` division panics, and two neighbouring operations answer wrongly in silence

>=0.0.0-0, <0.2.2 · fixed in 0.2.2

Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics

>=0.0.0-0, <0.3.5 || >=0.4.0-0, <0.4.0 · fixed in 0.3.5, 0.4.0

Russh: Channel-scoped server callbacks can be reached without an open channel

• Broken access control
• CWE-666

<0.62.5 · fixed in 0.62.5

Auto-Reseeding HMAC-DRBG could panic for some output lengths

>=0.0.0-0, <0.0.2 · fixed in 0.0.2

`nostr-relay-pool` is unmaintained

>=0.0.0-0 · no fixed version yet

`nostr-keyring` is unmaintained

>=0.0.0-0 · no fixed version yet

`nostr-relay-builder` is unmaintained

>=0.0.0-0 · no fixed version yet

Processing of unverified relay events

>=0.0.0-0, <0.44.3 · fixed in 0.44.3

Relay authentication challenges can exhaust memory

>=0.0.0-0, <0.44.3 · fixed in 0.44.3

Empty NIP-50 search filters can panic

>=0.0.0-0, <0.44.7 · fixed in 0.44.7

NIP-98 authorization parsing permits resource exhaustion

>=0.0.0-0, <0.44.7 · fixed in 0.44.7

NIP-04 parsing amplifies malformed ciphertext memory use

>=0.0.0-0, <0.44.7 · fixed in 0.44.7

NIP-44 v2 decryption permits resource exhaustion

>=0.0.0-0, <0.44.7 · fixed in 0.44.7

Wallet event parsers accept unauthenticated events

>=0.0.0-0, <0.44.7 · fixed in 0.44.7

Debug output exposes NIP-46 and NIP-60 credentials

>=0.0.0-0, <0.44.7 · fixed in 0.44.7

Verification cache poisoning allows forged Nostr events to bypass signature validation

>=0.0.0-0, <0.44.2 · fixed in 0.44.2

zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

• Denial of service

<0.4.1 · fixed in 0.4.1

Stores can mix up type indices between engines

• Memory corruption

Published by the maintainers · not yet reviewed by GitHub

>=0.0.0-0, <24.0.12 || >=25.0.0, <36.0.13 || >=37.0.0, <46.0.2 || >=47.0.0, <47.0.3 · fixed in 24.0.12, 36.0.13, 46.0.2, 47.0.3

Preemption and traps during bulk operations enable breaking internal VM state

• Race condition

Published by the maintainers · not yet reviewed by GitHub

>=46.0.0, <46.0.2 || >=47.0.0, <47.0.3 · fixed in 46.0.2, 47.0.3

Unix `BROWSER` handling allows browser argument injection

>=0.0.0-0, <1.2.2 · fixed in 1.2.2

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

• Path traversal
• CWE-61

>=0.5.0, <0.11.1 · fixed in 0.11.1

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

• CWE-636

<0.61.3 · fixed in 0.61.3

Remote Denial of Service via malformed NIP-04 IV

>=0.0.0-0, <0.44.6 || >=0.45.0-alpha.1, <0.45.0-alpha.6 · fixed in 0.44.6, 0.45.0-alpha.6

Remote Denial of Service via malformed NIP‑44 v2 payload

>=0.0.0-0, <0.44.5 || >=0.45.0-alpha.1, <0.45.0-alpha.5 · fixed in 0.44.5, 0.45.0-alpha.5

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

• Denial of service

<0.66.5 · fixed in 0.66.5

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

• Information disclosure

<0.6.1 · fixed in 0.6.1

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

• CWE-693

>=0.3.0, <0.6.1 · fixed in 0.6.1

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

• Information disclosure

>=0.0.1, <0.6.1 · fixed in 0.6.1

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

• CWE-704
• CWE-754

<0.62.4 · fixed in 0.62.4

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

• CWE-129

<0.62.4 · fixed in 0.62.4

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

• CWE-754

<0.62.4 · fixed in 0.62.4

smallstr is unmaintained

>=0.0.0-0 · no fixed version yet

gumdrop is unmaintained

>=0.0.0-0 · no fixed version yet

`Enum` trait allows type confusion when manually implemented

>=3.0.0-0.gat.0, <3.1.0 · fixed in 3.1.0

XSS in ammonia via SVG `animate` and `set` animation tags

• Cross-site scripting (XSS)

>=0.0.0-0, <3.3.3 || >=4.0.0, <4.0.3 || >=4.1.0, <4.1.4 · fixed in 3.3.3, 4.0.3, 4.1.4

Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

• Denial of service

* · no fixed version yet

Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation

• Weak cryptography or TLS

* · no fixed version yet

Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

• Broken access control

* · no fixed version yet

Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

• Broken access control

* · no fixed version yet