Tagged “rust”
CVEs tagged rust, newest first.
709 CVEsRSS
RUSTSEC-2026-0319Noneanymap2 is unmaintained
anymap2 is unmaintained
GHSA-cjcg-cxmh-9wcrHigh· 7.5Praxis affected by HTTP/2 Bomb
Praxis affected by HTTP/2 Bomb
GHSA-6g2r-675j-hx59Low· 2.3xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
CVE-2026-104855Low· 2.0⚖ disputedWasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder …
GHSA-c9xm-49cp-xcr9Mediumrmcp OAuth client fetches server-controlled resource_metadata URLs
rmcp OAuth client fetches server-controlled resource_metadata URLs
CVE-2026-104437High· 7.4PoCZebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 tran…
CVE-2026-104436Low· 3.7Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages …
CVE-2026-104435High· 7.4Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output
Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more in…
CVE-2026-104434Medium· 6.5ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…
ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying inva…
RUSTSEC-2026-0318NoneSending custom to-device messages may panics
Sending custom to-device messages may panics
RUSTSEC-2026-0317Medium· 5.5A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
CVE-2026-102825Low· 3.7PoCRussh is a Rust SSH client and server library
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max…
CVE-2026-102820Medium· 6.2PoCpageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance
pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::re…
CVE-2026-102823High· 7.5PoCRussh is a Rust SSH client and server library
Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, C…
CVE-2026-102822Low· 3.7PoCRussh is a Rust SSH client and server library
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC sele…
CVE-2026-102821Medium· 6.5PoCRussh is a Rust SSH client and server library
Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgre…
CVE-2026-102824Medium· 4.3Russh is a Rust SSH client and server library
Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secr…
RUSTSEC-2026-0330NoneHybrid Encapsulation from Seed Panics on Short Seed
Hybrid Encapsulation from Seed Panics on Short Seed
RUSTSEC-2026-0311NoneStack overflow on deeply nested LaTeX input
Stack overflow on deeply nested LaTeX input
RUSTSEC-2026-0374None`basic-toml` is unmaintained
`basic-toml` is unmaintained
RUSTSEC-2026-0310NoneVarious panics, soundness and resource exhaustion issues
Various panics, soundness and resource exhaustion issues
CVE-2026-97875High· 8.1Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding
Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local progr…
CVE-2026-115390Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
CVE-2026-115389Low· 2.3Dynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit
CVE-2026-115387Medium· 6.2Guest can panic host through filesystem datetime overflow
Guest can panic host through filesystem datetime overflow
RUSTSEC-2026-0316NoneDynamic record lifting can allocate beyond the hostcall fuel limit
Dynamic record lifting can allocate beyond the hostcall fuel limit
RUSTSEC-2026-0315Medium· 5.7`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
RUSTSEC-2026-0314Medium· 6.2Guest can panic host through filesystem datetime overflow
Guest can panic host through filesystem datetime overflow
RUSTSEC-2026-0313Medium· 6.2Outgoing HTTP body write allows guest-driven host memory exhaustion
Outgoing HTTP body write allows guest-driven host memory exhaustion
RUSTSEC-2026-0312High· 7.4Excluded iPAddress name constraints with an all-zero mask are not applied
Excluded iPAddress name constraints with an all-zero mask are not applied