matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a de…

▾ Twilightmatrix · matrix-rust-sdkEPSS 0.41%via NVD

Tagged “rust”

Name constraints for URI names were incorrectly accepted

Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Improperly masked return value from `table.grow` with Winch compiler backend

Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access

Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Out-of-bounds write or crash when transcoding component model strings

Use-after-free bug after cloning `wasmtime::Linker`

Panic when transcoding misaligned component model UTF-16 strings

Data leakage between pooling allocator instances

Host panic when Winch compiler executes `table.fill`

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64

Host data leakage with 64-bit tables and Winch

Panic when lifting `flags` component value

Rand is unsound with a custom logger using `rand::rng()`

Stubbed cryptography without warnings

CRLs not considered authoritative by Distribution Point due to faulty matching logic

RustSec Advisory

uv has ZIP payload obfuscation through parsing differentials

Panic adding excessive fields to a `wasi:http/types.fields` instance

Guest-controlled resource exhaustion in WASI implementations

Panic when dropping a `[Typed]Func::call_async` future

Integer overflow in `BytesMut::reserve`

dcap-qvl has Missing Verification for QE Identity

Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

Non-constant-time code generation on ARM32 targets

theshit vulnerable to unsafe loading of user-owned Python rules when running as root

`Bitmap::try_from(&[u8])` can create invalid values

Timing side-channel in ML-DSA decomposition

matrix-sdk-base is the base component to build a Matrix client library