Tagged “rust”
CVEs tagged rust, newest first.
740 CVEsRSS
CVE-2025-64345Low· 1.8Unsound API access to a WebAssembly shared linear memory
Unsound API access to a WebAssembly shared linear memory
RUSTSEC-2025-0154None`replit_ruspty` was removed from crates.io for malicious code
`replit_ruspty` was removed from crates.io for malicious code
MAL-2025-49350NoneMalicious code in replit_ruspty (crates.io)
Malicious code in replit_ruspty (crates.io)
CVE-2025-62711Low· 3.1Wasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. In versions from 38.0.0 to before 38.0.3, the implementation of component-model related host-to-wasm trampolines in Wasmtime contained a bug where it's possible to carefully craft a component, which…
CVE-2025-62518High· 8.1PoCastral-tokio-tar is a tar archive reading/writing library for async Rust
astral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inco…
CVE-2025-62370High· 7.5Alloy Core libraries at the root of the Rust Ethereum ecosystem
Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered by malformed input to alloy_dyn_abi::TypedData could lead to a denial-of-service (DoS) via eip712_signing_hash(). Sof…
CVE-2025-59047Nonematrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method
matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method
CVE-2025-58160NoneLogging user input may result in poisoning logs with ANSI escape sequences
Logging user input may result in poisoning logs with ANSI escape sequences
CVE-2025-55159NoneOut-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
CVE-2025-53901Low· 3.3Host panic with `fd_renumber` WASIp1 function
Host panic with `fd_renumber` WASIp1 function
RUSTSEC-2025-0172None`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead
CVE-2025-53549Nonematrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`
matrix-sdk-sqlite: SQL injection vulnerability in `SqliteEventCacheStore::find_event_with_relations`
CVE-2025-48937Medium· 4.9matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator
CVE-2025-5791High· 7.1Users: `root` appended to group listings
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in …
CVE-2025-48935None--allow-read / --allow-write permission bypass in `node:sqlite`
--allow-read / --allow-write permission bypass in `node:sqlite`
RUSTSEC-2025-0173None`PamHandle::get_user` can cause an authentication bypass
`PamHandle::get_user` can cause an authentication bypass
RUSTSEC-2025-0171Nonesoundness issue
soundness issue
RUSTSEC-2025-0170None`hugepage_rs::dealloc` may allow invalid memory deallocation from safe code
`hugepage_rs::dealloc` may allow invalid memory deallocation from safe code
RUSTSEC-2025-0169None`FormatContext` stream accessors can cause undefined behavior from safe code
`FormatContext` stream accessors can cause undefined behavior from safe code
CVE-2025-31130Medium· 6.8SHA-1 collision attacks are not detected
SHA-1 collision attacks are not detected
CVE-2025-29787HighIncorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
CVE-2025-24898Medium· 4.8rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)
A flaw was found in the rust-openssl package. In certain versions, `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever`…
CVE-2025-22620Medium· 5.0PoCgix-worktree-state nonexclusive checkout sets executable files world-writable
gix-worktree-state nonexclusive checkout sets executable files world-writable
RUSTSEC-2024-0433NoneMalicious plugin names, recipients, or identities can cause arbitrary binary execution
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
RUSTSEC-2024-0432NoneMalicious plugin names, recipients, or identities can cause arbitrary binary execution
Malicious plugin names, recipients, or identities can cause arbitrary binary execution
CVE-2024-53856High· 7.5Panics on Malformed Untrusted Input
Panics on Malformed Untrusted Input
RUSTSEC-2024-0448None`parse_arguments` reads a caller-supplied pointer as a slice
`parse_arguments` reads a caller-supplied pointer as a slice
RUSTSEC-2024-0401Medium· 5.3Denial of service because of stack overflow with malicious decompression input
Denial of service because of stack overflow with malicious decompression input
CVE-2024-51756Nonecap-primitives doesn't fully sandbox all the Windows device filenames
cap-primitives doesn't fully sandbox all the Windows device filenames
CVE-2024-51745NoneWasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime doesn't fully sandbox all the Windows device filenames