libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)

GHSA-2fjw-whxm-9v4q CRITICAL 3 days ago

A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a sm...

cargo

No PRs yet

cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

GHSA-8frv-q972-9rq5 CVE-2025-66017 HIGH 3 days ago

### Impact This attack is against presignatures used in very specific context: * Presignatures + HD wallets derivation: security level reduces to 8...

cargo

No PRs yet

cggmp21 has a missing check in the ZK proof used in CGGMP21

GHSA-m95p-425x-x889 CVE-2025-66016 CRITICAL 3 days ago

### Impact cggmp21 concerns a missing check in the ZK proof that enables an attack in which a single malicious signer can reconstruct full private...

cargo

No PRs yet

thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS

GHSA-jf9p-2fv9-2jp2 CVE-2025-65947 HIGH 7 days ago

Affected versions of this crate contain resource leaks when querying thread counts on Windows and Apple platforms. ### Windows The `thread_amount`...

cargo

No PRs yet

sudo-rs doesn't record authenticating user properly in timestamp

GHSA-q428-6v73-fc4q CVE-2025-64517 MODERATE 15 days ago

### Summary When `Defaults targetpw` (or `Defaults rootpw`) is enabled, the password of the target account (or root account) instead of the invokin...

cargo

No PRs yet

Wasmtime provides unsound API access to a WebAssembly shared linear memory

GHSA-hc7m-r6v8-hg9q CVE-2025-64345 LOW 16 days ago

### Impact Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which p...

cargo

2

Dependabot PRs

sudo-rs: Partial password reveal is possible after timeout

GHSA-c978-wq47-pvvw CVE-2025-64170 LOW 16 days ago

### Summary If a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens,...

cargo

No PRs yet

Apollo Router Affected by an Access Control Bypass on Polymorphic Types

GHSA-x33c-7c2v-mrj9 CVE-2025-64173 HIGH 22 days ago

# Summary A vulnerability in Apollo Router allowed for unauthenticated queries to access data that required additional access controls. Router inc...

cargo

No PRs yet

Apollo Router Improperly Enforces Renamed Access Control Directives

GHSA-g8jh-vg5j-4h3f CVE-2025-64347 HIGH 22 days ago

# Summary A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directive...

cargo

No PRs yet

youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

GHSA-vf95-55w6-qmrf CVE-2025-62596 HIGH 23 days ago

### Impact ### youki’s apparmor handling performs insufficiently strict write-target validation, which—combined with path substitution during path...

cargo

No PRs yet

youki container escape via "masked path" abuse due to mount race conditions

GHSA-4g74-7cff-xcv8 CVE-2025-62161 HIGH 23 days ago

### Impact ### youki utilizes bind mounting the container's `/dev/null` as a file mask. When performing this operation, the initial validation of ...

cargo

No PRs yet

Shaman has soundness issues and is unmaintained

GHSA-7vjm-6qgq-3mrq LOW 25 days ago

`shaman::cryptoutil::write_u64v_le` and other functions mentioned above cannot garantee memory safety of get_unchecked later if both length are zer...

cargo

No PRs yet

Wasmtime vulnerable to segfault when using component resources

GHSA-4h67-722j-5pmc CVE-2025-62711 LOW about 1 month ago

### Impact The implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully cra...

cargo

1

Dependabot PRs

binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

GHSA-wwxp-hxh6-8gf8 HIGH about 1 month ago

Safe functions accept a single `&T` or `&mut T` but multiply by `n` to create slices extending beyond allocated memory when `n > 1`. These functio...

cargo

No PRs yet

ncurses exposes uninitialized memory in string reading functions

GHSA-x77x-7mmh-cxv3 MODERATE about 1 month ago

Multiple string reading functions expose uninitialized memory by setting length to capacity when no null terminator is found. This allows reading ...

cargo

No PRs yet

Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice

GHSA-xcpm-76hf-c9cc LOW about 1 month ago

The safe function `any_as_u8_slice` can create byte slices that reference uninitialized memory when used with types containing padding bytes. The ...

cargo

No PRs yet

Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer

GHSA-fp5x-7m4q-449f LOW about 1 month ago

The safe function `create_ring_buffer` allocates a buffer using `Vec::with_capacity` followed by `set_len`, creating a `Box<[T]>` containing uninit...

cargo

No PRs yet

orx-pinned-vec has undefined behavior in index_of_ptr with empty slices

GHSA-h5j3-crg5-8jqm LOW about 1 month ago

The safe function `index_of_ptr` causes undefined behavior when called with an empty slice. The issue occurs in the line `ptr.add(slice.len() - 1)...

cargo

No PRs yet

astral-tokio-tar Vulnerable to PAX Header Desynchronization

GHSA-j5gw-2vrg-8fgx CVE-2025-62518 HIGH about 1 month ago

## Summary Versions of `astral-tokio-tar` prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional arch...

cargo

7

Dependabot PRs

alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

GHSA-pgp9-98jm-wwq2 CVE-2025-62370 HIGH about 1 month ago

### Impact An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signin...

cargo

16

Dependabot PRs

12%

Merged

tracexec has `env` command argument injection via environment variables starting with dash in traced exec events

GHSA-6fgx-x7m2-74qm LOW about 2 months ago

### Impact For tracexec's command line reconstruction feature, when a traced process executes another process with a environment variable where th...

cargo

No PRs yet

MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

GHSA-3p6w-gv5g-xjw9 CVE-2025-11695 HIGH about 2 months ago

When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver versions...

cargo

No PRs yet

cel-rust May Panic During Parsing of Invalid CEL Expressions

GHSA-wxwx-9fh7-5mrw CVE-2025-62162 HIGH about 2 months ago

### Summary Parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate u...

cargo

No PRs yet

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

GHSA-m2gf-x3f6-8hq3 CVE-2025-61787 HIGH about 2 months ago

### Summary Deno versions up to 2.5.1 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. ### Details In Wi...

cargo

No PRs yet

Deno's --deny-read check does not prevent permission bypass

GHSA-qq26-84mh-26j9 CVE-2025-61786 LOW about 2 months ago

### Summary `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It...

cargo

No PRs yet

FuelVM is vulnerable to heap memory allocation re-use bug

GHSA-2pgj-5cv2-6xxw HIGH about 2 months ago

### Impact A memory safety vulnerability was present in the Fuel Virtual Machine (FuelVM), where memory reads could bypass expected access control...

cargo

No PRs yet

Deno's --deny-write check does not prevent permission bypass

GHSA-vg2r-rmgp-cgqj CVE-2025-61785 LOW about 2 months ago

### Summary `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. ...

cargo

No PRs yet

wrflib has a soundness issue and is unmaintained

GHSA-466c-pfvv-v83g LOW about 2 months ago

All functions under `wrflib::byte_extract` are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset paramet...

cargo

No PRs yet

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

GHSA-jqq4-c7wq-36h7 CVE-2025-61588 CRITICAL about 2 months ago

# Arbitrary code execution in guest via memory safety failure in `sys_read` In affected versions of `risc0-zkvm-platform`, when the zkVM guest cal...

cargo

No PRs yet

OpenMLS improper persistence of the secret tree during message processing

GHSA-qr9h-x63w-vqfm MODERATE 2 months ago

### Summary A bug in the OpenMLS library prevented private key material from being updated in storage during message processing. The key material ...

cargo

No PRs yet

astral-tokio-tar has a path traversal in tar extraction

GHSA-3wgq-wrwc-vqmv CVE-2025-59825 MODERATE 2 months ago

### Impact In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using ...

cargo

No PRs yet

Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

GHSA-mm7x-qfjj-5g2c LOW 2 months ago

Affected versions of this crate did not correctly strip namespace-incompatible tags in certain situations, causing it to incorrectly account for di...

cargo

No PRs yet

Pingora update for MadeYouReset HTTP/2 vulnerability

GHSA-393w-9x6h-8gc7 HIGH 2 months ago

Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, P...

cargo

No PRs yet

FUSE-Rust: Uninitalized memory read and leak caused by fuser crate

GHSA-cvmj-47v9-35m9 HIGH 2 months ago

During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argum...

cargo

No PRs yet

serde_yml crate is unsound and unmaintained

GHSA-hhw4-xg65-fp2x MODERATE 2 months ago

Using `serde_yml::ser::Serializer.emitter` can cause a segmentation fault, which is unsound. The GitHub project for `serde_yml` was archived after...

cargo

No PRs yet

LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

GHSA-gfxp-f68g-8x78 HIGH 2 months ago

In version 0.0.4, `libyml::string::yaml_string_extend` was revised resulting in undefined behaviour, which is unsound. The GitHub project for `lib...

cargo

No PRs yet

fast-able is vulnerable to DoS attack through insecure method

GHSA-95hm-pr6q-298w HIGH 2 months ago

The public accessible struct SyncVec has a public safe method get_unchecked. It accept a parameter index and used in the get_unchecked without suff...

cargo

No PRs yet

httpsig-rs: HMAC verification is vulnerable to timing attack

GHSA-q7pg-9pr4-mrp2 CVE-2025-59058 MODERATE 3 months ago

### Summary HMAC signature comparison is not timing-safe and is vulnerable to timing attacks. ### Details `SharedKey::sign()` returns a `Vec<u8>` ...

cargo

No PRs yet

SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

GHSA-7vm2-j586-vcvc CVE-2025-11060 MODERATE 3 months ago

`LIVE SELECT` statements are used to capture changes to data within a table in real time. Documents included in `WHERE` conditions and `DELETE` not...

cargo

No PRs yet

matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method

GHSA-qhj8-q5r6-8q6j CVE-2025-59047 LOW 3 months ago

In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalized_power_level()` method can cause a panic if a room member has a power level of...

cargo

No PRs yet

toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor

GHSA-pfp7-vxgr-83pw HIGH 3 months ago

An off-by-one error in the `DrainCol::drop` destructor could cause an unsafe memory copy operation to exceed the bounds of the associated vector. ...

cargo

No PRs yet

frost-core: refresh shares with smaller min_signers will reduce security of group

GHSA-wgq8-vr6r-mqxm CVE-2025-58359 MODERATE 3 months ago

### Impact It was not clear that it is not possible to change `min_signers` (i.e. the threshold) with the refresh share functionality (`frost_core...

cargo

No PRs yet

ArrayQueue's push_front is not panic-safe

GHSA-xqjr-wfx3-gmxv MODERATE 3 months ago

The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` metho...

cargo

No PRs yet

arenavec has multiple memory corruption vulnerabilities in safe APIs

GHSA-3632-54q8-m96x HIGH 3 months ago

The crate has the following vulnerabilities: - The public trait `arenavec::common::AllocHandle` allows the return of raw pointers through its meth...

cargo

No PRs yet

Tracing logging user input may result in poisoning logs with ANSI escape sequences

GHSA-xwfj-jgwm-7wp5 CVE-2025-58160 LOW 3 months ago

### Impact Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI...

cargo

No PRs yet

webp crate may expose memory contents when encoding an image

GHSA-9q78-27f3-2jmh MODERATE 3 months ago

Affected versions of this crate did not check that the input slice passed to `"webp::Encoder::encode()` is large enough for the specified image dim...

cargo

No PRs yet

DoS Vulnerability in ntpd-rs

GHSA-4855-q42w-5vr4 CVE-2025-58066 MODERATE 3 months ago

# Summary A denial of service vulnerability was discovered in ntpd-rs where an attacker can induce a message storm between two NTP servers running...

cargo

No PRs yet

Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety

GHSA-655h-hg88-5qmf LOW 3 months ago

The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constr...

cargo

No PRs yet

IdMap from_iter may lead to uninitialized memory being freed on drop

GHSA-qq4c-hm99-979m MODERATE 3 months ago

Due to a flaw in the constructor `id_map::IdMap::from_iter`, ill-formed objects may be created in which the amount of actually initialized memory i...

cargo

No PRs yet

User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows

GHSA-77h3-w9rx-hj3q MODERATE 4 months ago

The `get` and `set` methods of the public trait `scratchpad::Tracking` interact with unsafe code regions in the crate, and they influence the compu...

cargo

No PRs yet