Tagged “rust”
CVEs tagged rust, newest first.
714 CVEsRSS
RUSTSEC-2026-0271NoneFTP command injection via CRLF in control channel arguments
FTP command injection via CRLF in control channel arguments
GHSA-vjf8-9fx6-mv6xMediumTriton VM Soundness Vulnerability due to Missing Constraint
Triton VM Soundness Vulnerability due to Missing Constraint
CVE-2026-52736HighZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash. ZIP-244 permits the…
CVE-2026-52735CriticalZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcod…
CVE-2026-52737Medium· 5.3ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block w…
CVE-2026-52738MediumZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalized_state/zebra_…
CVE-2026-52739Medium· 5.9ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finali…
CVE-2026-52733Medium· 6.5ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/…
CVE-2026-52734Medium· 5.3ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verification reaches the outer RATE_LIMIT_DELAY timeout. In zebrad/src/compo…
CVE-2026-52829High· 7.5ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized …
CVE-2026-52731Medium· 6.5ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-r…
CVE-2026-52732Medium· 5.3ZEBRA is a Zcash node written entirely in Rust
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/memp…
RUSTSEC-2026-0342NoneZero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto
RUSTSEC-2026-0341High· 7.5Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed
RUSTSEC-2026-0339NoneUnbounded growth of pending connection ID retirements in quinn-proto
Unbounded growth of pending connection ID retirements in quinn-proto
RUSTSEC-2026-0258Noneh2 unbounded empty DATA frames
h2 unbounded empty DATA frames
RUSTSEC-2026-0290High· 7.4pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
RUSTSEC-2026-0288High· 7.4cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
RUSTSEC-2026-0275Medium· 6.5Legacy `azure_core` writes the `authorization` header value to logs
Legacy `azure_core` writes the `authorization` header value to logs
RUSTSEC-2026-0334Critical· 9.1BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses
BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses
CVE-2026-63740Medium· 6.5SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
CVE-2026-73051Mediumactix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit …
CVE-2026-72813High· 7.5actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files
actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET reque…
CVE-2026-72814Medium· 5.3The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability
The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the serv…
CVE-2026-10740Medium· 5.3s2n-quic has excessive memory allocation
s2n-quic has excessive memory allocation
GHSA-8rw6-p7m8-63jpMedium· 6.5SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
CVE-2026-73489Medium· 4.3Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypt…
RUSTSEC-2026-0295NoneMemory corruption bug on `ApplyResult` type
Memory corruption bug on `ApplyResult` type
CVE-2026-73429Medium· 5.3Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve255…
CVE-2026-73430Medium· 5.3Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve…