agentprime Advisories: crates.io

`astral-tokio-tar` is unmaintained

Tue, 03 Nov 2026 12:00:00 GMT

astral-tokio-tar >=0.0.0-0, no fixed version yet. Published by OSV. Not analysed by agentprime yet.

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Mon, 02 Nov 2026 12:00:00 GMT

arrow-data >=33.0.0, <57.3.2 || >=58.0.0, <58.4.1 || >=59.0.0, <59.3.2 || >=60.0.0, <60.1.0, fixed in 57.3.2, 58.4.1, 59.3.2, 60.1.0. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Unbounded memory allocation in `evtx` parsing a `.wevtcache` file

Sun, 01 Nov 2026 12:00:00 GMT

evtx >=0.11.0, <0.15.1, fixed in 0.15.1. CVSS 5.5 (Medium). Published by OSV. Not analysed by agentprime yet.

Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)

Sun, 01 Nov 2026 12:00:00 GMT

rio-vt >=0.0.0-0, <0.5.29, fixed in 0.5.29. CVSS 4.7 (Medium). Published by OSV. Not analysed by agentprime yet.

`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

Sat, 31 Oct 2026 12:00:00 GMT

ant-releases >=0.0.0-0, no fixed version yet. CVSS 8.2 (High). Published by OSV. Not analysed by agentprime yet.

`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)

Sat, 31 Oct 2026 12:00:00 GMT

codeq >=0.0.0-0, <0.6.3, fixed in 0.6.3. CVSS 5.3 (Medium). Published by OSV. Not analysed by agentprime yet.

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

Fri, 30 Oct 2026 22:59:08 GMT

russh <0.65, fixed in 0.65. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)

Fri, 30 Oct 2026 22:59:00 GMT

pageant >=0.2.0, <0.2.5, fixed in 0.2.5. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

Fri, 30 Oct 2026 22:58:53 GMT

russh >=0.60.0, <0.65, fixed in 0.65. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

Fri, 30 Oct 2026 22:58:47 GMT

russh <0.65.0, fixed in 0.65.0. CVSS 3.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

Fri, 30 Oct 2026 22:58:39 GMT

russh <0.65, fixed in 0.65. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)

Fri, 30 Oct 2026 12:00:00 GMT

nix-nar >=0.0.0-0, <0.6.0, fixed in 0.6.0. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.

BLAKE2b produces wrong tag when using `reset()` with a different-length key

Fri, 30 Oct 2026 12:00:00 GMT

orion >=0.0.0-0, <0.17.16 || >=0.18.0-0, <0.18.1, fixed in 0.17.16, 0.18.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time

Fri, 30 Oct 2026 12:00:00 GMT

orion >=0.0.0-0, <0.17.16 || >=0.18.0-0, <0.18.1, fixed in 0.17.16, 0.18.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

Thu, 29 Oct 2026 16:40:19 GMT

zip >=5.1.0, <9.0.0, fixed in 9.0.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

Thu, 29 Oct 2026 16:40:12 GMT

zip >=7.2.0, <9.0.0, fixed in 9.0.0. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

zip: AES Entry HMAC Authentication Bypass on Premature EOF

Thu, 29 Oct 2026 16:40:07 GMT

zip >=0.6.0, <9.0.0, fixed in 9.0.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

Thu, 29 Oct 2026 16:40:01 GMT

zip >=1.3.0, <9.0.0, fixed in 9.0.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence

Thu, 29 Oct 2026 16:35:04 GMT

cedar-policy >=3.0.0, <3.4.3 || >=4.0.0, <4.11.1, fixed in 3.4.3, 4.11.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)

Thu, 29 Oct 2026 12:00:00 GMT

sn-releases >=0.0.0-0, no fixed version yet. CVSS 8.8 (High). Published by OSV. Not analysed by agentprime yet.

Cross-engine type confusion with host-created struct-types-with-supertypes

Thu, 29 Oct 2026 12:00:00 GMT

wasmtime >=47.0.0, <48.0.8 || >=49.0.0, <49.0.5 || >=50.0.0, <50.0.1, fixed in 48.0.8, 49.0.5, 50.0.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving

Thu, 29 Oct 2026 12:00:00 GMT

wasmtime-wasi >=48.0.0, <48.0.8 || >=49.0.0, <49.0.5 || >=50.0.0, <50.0.1, fixed in 48.0.8, 49.0.5, 50.0.1. CVSS 6.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

wasi-http p2: outgoing content-length can be invalid or not match body

Thu, 29 Oct 2026 12:00:00 GMT

wasmtime-wasi-http >=0.0.0-0, <36.0.20 || >=37.0.0, <48.0.8 || >=49.0.0, <49.0.5 || >=50.0.0, <50.0.1, fixed in 36.0.20, 48.0.8, 49.0.5, 50.0.1. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Unbounded memory use on large request bodies

Thu, 29 Oct 2026 12:00:00 GMT

juniper_warp >=0.0.0-0, <0.9.1, fixed in 0.9.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Unchecked memory usage in transferring borrowed resources between components

Thu, 29 Oct 2026 12:00:00 GMT

wasmtime >=0.0.0-0, <36.0.20 || >=37.0.0, <48.0.8 || >=49.0.0, <49.0.5 || >=50.0.0, <50.0.1, fixed in 36.0.20, 48.0.8, 49.0.5, 50.0.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check

Thu, 29 Oct 2026 12:00:00 GMT

wasmtime >=47.0.0, <48.0.8 || >=49.0.0, <49.0.5 || >=50.0.0, <50.0.1, fixed in 48.0.8, 49.0.5, 50.0.1. CVSS 1.8 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Wed, 28 Oct 2026 21:14:14 GMT

wasmtime <36.0.19 || >=37.0.0, <48.0.7 || >=49.0.0, <49.0.4, fixed in 36.0.19, 48.0.7, 49.0.4. CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Wed, 28 Oct 2026 21:09:50 GMT

zip <9.0.5, fixed in 9.0.5. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input

Wed, 28 Oct 2026 12:00:00 GMT

calamine >=0.0.0-0, <0.38.0, fixed in 0.38.0. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.

Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`

Wed, 28 Oct 2026 12:00:00 GMT

pulldown-cmark >=0.13.0, <0.13.6, fixed in 0.13.6. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.

Unbounded memory use on large request bodies

Wed, 28 Oct 2026 12:00:00 GMT

juniper_hyper >=0.0.0-0, <0.10.1, fixed in 0.10.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

libz-sys build script leaks environment variables in the build directory

Wed, 28 Oct 2026 12:00:00 GMT

libz-sys >=1.0.21, <1.1.31, fixed in 1.1.31. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Excessive CPU and memory use on crafted GraphQL documents

Wed, 28 Oct 2026 12:00:00 GMT

juniper >=0.0.0-0, <0.17.2, fixed in 0.17.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Stack overflow on deeply nested GraphQL documents

Wed, 28 Oct 2026 12:00:00 GMT

juniper >=0.0.0-0, <0.17.2, fixed in 0.17.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

Tue, 27 Oct 2026 16:08:59 GMT

rustls >=0.23.44, <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2, fixed in 0.23.46, 0.24.0-dev.2. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

Tue, 27 Oct 2026 16:08:54 GMT

rustls <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2, fixed in 0.23.46, 0.24.0-dev.2. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

Tue, 27 Oct 2026 16:08:47 GMT

rustls <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2, fixed in 0.23.46, 0.24.0-dev.2. CVSS 4.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

Tue, 27 Oct 2026 16:08:36 GMT

rustls <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2, fixed in 0.23.46, 0.24.0-dev.2. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Arbitrary code execution when rerunning tests from a portable recording

Mon, 26 Oct 2026 12:00:00 GMT

cargo-nextest >=0.9.125, <0.9.150, fixed in 0.9.150. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Use-after-free of caller-owned server name in client connection constructors

Mon, 26 Oct 2026 12:00:00 GMT

rustls-ffi >=0.12.0, <0.15.7, fixed in 0.15.7. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Use-after-free from a comparator that answers inconsistently

Sat, 24 Oct 2026 12:00:00 GMT

skiplist >=0.0.0-0, <1.3.0, fixed in 1.3.0. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Aliasing violations in splice, mutable iteration and cursors

Sat, 24 Oct 2026 12:00:00 GMT

skiplist >=0.0.0-0, <1.3.0, fixed in 1.3.0. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

Fri, 23 Oct 2026 21:58:16 GMT

fallow-cli <3.34.0, fixed in 3.34.0. CVSS 3.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Fri, 23 Oct 2026 21:57:37 GMT

fallow-cli >=2.68.0, <3.34.0, fixed in 3.34.0. CVSS 3.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

Fri, 23 Oct 2026 20:52:28 GMT

gix >=0.88.0, <0.90.0, fixed in 0.90.0. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Multiple timing variability issues in operations intended to be constant-time

Fri, 23 Oct 2026 12:00:00 GMT

crypto-bigint >=0.0.0-0, <0.7.6, fixed in 0.7.6. Published by OSV. Not analysed by agentprime yet.

Non-constant-time mask generation and `u128` comparisons

Fri, 23 Oct 2026 12:00:00 GMT

ctutils >=0.0.0-0, <0.4.4, fixed in 0.4.4. Published by OSV. Not analysed by agentprime yet.

ammonia: mXSS via MathML `annotation-xml` encoding strip

Thu, 22 Oct 2026 14:06:10 GMT

ammonia <3.3.2 || >=4.0.0, <4.0.2 || >=4.1.0, <4.1.3, fixed in 3.3.2, 4.0.2, 4.1.3. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`

Thu, 22 Oct 2026 12:00:00 GMT

dahl-salso >=0.0.0-0, <0.7.0, fixed in 0.7.0. Published by OSV. Not analysed by agentprime yet.

SSRF and local file disclosure via unvalidated URLs

Thu, 22 Oct 2026 12:00:00 GMT

webpage >=0.0.0-0, <2.1.0, fixed in 2.1.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.