Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder …

▾ Sunlitbytecodealliance · wasmtimeEPSS 0.28%via NVD

GHSA-c9xm-49cp-xcr9Medium

3w ago

rmcp OAuth client fetches server-controlled resource_metadata URLs

▾ Sunlitrmcp · rmcpvia OSV

CVE-2026-104437High· 7.4PoC

3w ago

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 tran…

▾ MidnightZcashFoundation · zebraEPSS 0.25%via NVD

CVE-2026-104436Low· 3.7

3w ago

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages …

▾ SunlitZcashFoundation · zebraEPSS 0.27%via NVD

CVE-2026-104435High· 7.4

3w ago

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more in…

▾ TwilightZcashFoundation · zebraEPSS 0.21%via NVD

CVE-2026-104434Medium· 6.5

3w ago

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…

▾ SunlitZcashFoundation · zebraEPSS 0.31%via NVD

RUSTSEC-2026-0318None

4w ago

Sending custom to-device messages may panics

▾ Sunlitmatrix-sdk-crypto · matrix-sdk-cryptovia OSV

RUSTSEC-2026-0317Medium· 5.5

4w ago

A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

▾ Sunlitsheets-diff · sheets-diffvia OSV

CVE-2026-102825Low· 3.7PoC

4w ago

Russh is a Rust SSH client and server library

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max…

▾ TwilightEugeny · russhEPSS 0.35%via NVD

CVE-2026-102820Medium· 6.2PoC

4w ago

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::re…

▾ TwilightEugeny · russhEPSS 0.19%via NVD

Tagged “rust”

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

hickory-resolver follows irrelevant CNAME records

Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

fd_readdir copies uninitialized struct padding into guest memory

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

Wasmtime wasi:http implementation panics with a zero timeout supplied

Mis-typed WebAssembly tag imports can lead to GC heap corruption

Rooting for GC values live across `try_call` may be missing, causing GC heap corruption

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

Rooting for GC values live across `try_call` may be missing, causing GC heap corruption

Mis-typed WebAssembly tag imports can lead to GC heap corruption

Guest can panic host through filesystem timestamp before the epoch on wasip3

fd_readdir copies uninitialized struct padding into guest memory

Excessive allocated memory on the host when guests don't have stdio

WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption

Wasmtime wasi:http implementation panics with a zero timeout supplied

anymap2 is unmaintained

Praxis affected by HTTP/2 Bomb

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

Wasmtime is a runtime for WebAssembly

rmcp OAuth client fetches server-controlled resource_metadata URLs

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…

Sending custom to-device messages may panics

A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Russh is a Rust SSH client and server library

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance