Zeros312
CVE-2020-35902 | cargo | cargo/actix-codec | Use-after-free in actix-codec | An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed. | <0.3.0 | ['0.3.0'] | ['CVE-2020-35902', 'GHSA-rqgx-hpg4-456r'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35902', 'https://github.com/advisories/GHSA-rqgx-hpg4-456r', 'https://github.com/actix/actix-net/issues/91', 'https://github.com/actix/actix-net/commit/c41b5d8dd4235ccca84d0b687996615c0c64d956', 'https://github.com/actix/actix-net', 'https://rustsec.org/advisories/RUSTSEC-2020-0049.html'] | 25f45ae4a6893d2a559ba58ba5be36ae7043b16495d79b12a37498ad994e62e7 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2024-43783 | cargo | cargo/apollo-router | Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies | Instances of the Apollo Router using either of the following may be impacted by a denial-of-service vulnerability.
1. External Coprocessing with specific configurations; or
2. Native Rust Plugins accessing the Router request body in the RouterService layer
Router customizations using Rhai scripts are **not** impacted. | >=1.7.0 <1.52.1 | ['1.52.1'] | ['CVE-2024-43783', 'GHSA-x6xq-whh3-gg32'] | ['https://nvd.nist.gov/vuln/detail/CVE-2024-43783', 'https://github.com/advisories/GHSA-x6xq-whh3-gg32', 'https://github.com/apollographql/router/security/advisories/GHSA-x6xq-whh3-gg32', 'https://github.com/apollographql/router/commit/7a9c020608a62dcaa306b72ed0f6980f15923b14', 'https://github.com/apollographql/router', 'https://github.com/apollographql/router/releases/tag/v1.52.1'] | 8eb8ab345bb45e5d8a2a66caecb7a594140f90d1d5097e853284c2da41b1d230 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-32034 | cargo | cargo/apollo-router | Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion | A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. This could lead to excessive resource consumption and denial of service. | <1.61.2||>=2.0.0-alpha.0 <2.1.1 | ['1.61.2', '2.1.1'] | ['CVE-2025-32034', 'GHSA-75m2-jhh5-j5g2'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-32034', 'https://github.com/advisories/GHSA-75m2-jhh5-j5g2', 'https://github.com/apollographql/router/security/advisories/GHSA-75m2-jhh5-j5g2', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | be8a92146b00f4e2fe1456732d42a076a6434357a682a3f0a7c842c687438e17 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-64347 | cargo | cargo/apollo-router | Apollo Router Improperly Enforces Renamed Access Control Directives | A vulnerability in Apollo Router allowed for unauthorized access to protected data through schema elements with access control directives (`@authenticated`, `@requiresScopes`, and `@policy`) that were renamed via `@link` imports. Router did not enforce renamed access control directives on schema elements (e.g. fields and types), allowing queries to bypass those element-level access controls. | <1.61.12||>=2.0.0-alpha.0 <2.8.1 | ['1.61.12', '2.8.1'] | ['CVE-2025-64347', 'GHSA-g8jh-vg5j-4h3f'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-64347', 'https://github.com/advisories/GHSA-g8jh-vg5j-4h3f', 'https://github.com/apollographql/router/security/advisories/GHSA-g8jh-vg5j-4h3f', 'https://github.com/apollographql/router/commit/78e4b20a2fc26cc5f141aa47992ed85375266a2b', 'https://github.com/apollographql/router'] | 1f2e69d3a23f555fc8a798222c2e48a2929f630fca6b24984de5bf29f04fc19b | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-3j43-9v8v-cp3f | cargo | cargo/apollo-router | Duplicate | This advisory duplicates another. | <0 | ['GHSA-3j43-9v8v-cp3f'] | ['https://github.com/advisories/GHSA-3j43-9v8v-cp3f', 'https://github.com/apollographql/router/security/advisories/GHSA-3j43-9v8v-cp3f', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | d0397f49f5329de27292634432111f3d216850f77c7258271d719aaf8e1c4bd9 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-hff2-gcpx-8f4p | cargo | cargo/apollo-router | Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery | In a Cross-Site Request Forgery attack, untrusted web content causes browsers to send authenticated requests to web servers which use cookies for authentication. While the web content is prevented from reading the request's response due to the Cross-Origin Request Sharing (CORS) protocol, the attacker may be able to cause side effects in the server ("CSRF" attack), or learn something about the response via timing analysis ("XS-Search" attack).
Apollo Router has a built-in feature which prevents CSRF and XS-Search attacks: it refuses to process GraphQL requests that could possibly have been sent by a spec-compliant web browser without a protective "preflight" step. See [Apollo Router's docs](https://www.apollographql.com/docs/graphos/routing/security/csrf) for more details on CORS, CSRF attacks, and Apollo Router's CSRF prevention feature.
This feature is fully effective against attacks carried out against users of spec-compliant browsers. Unfortunately, a major browser introduced a bug in 2025 which meant in certain cases, it failed to follow the CORS spec. The browser's maintainers have already committed to fixing the bug and making the browser spec-compliant again.
Even with this bug, Apollo Router's CSRF prevention feature **blocks** "side effect" CSRF attacks: Apollo Router will still correctly refuse to execute _mutations_ in requests that were not preflighted. However, some specially crafted authenticated GraphQL _queries_ can be issued across origins *without preflight* in buggy versions of this browser, allowing for XS-Search attacks: an attacker can analyze response times to learn facts about the responses to requests such as whether fields return null or approximately how many list entries are returned from fields.
Apollo Router installations are only vulnerable if they rely on cookies (or HTTP Basic Auth) for authentication. | >=2.11.0 <2.12.1||>=2.0.0 <2.10.2||<1.61.13 | ['2.12.1', '2.10.2', '1.61.13'] | ['GHSA-hff2-gcpx-8f4p'] | ['https://github.com/advisories/GHSA-hff2-gcpx-8f4p', 'https://github.com/apollographql/apollo-server/security/advisories/GHSA-9q82-xgwf-vj6h', 'https://github.com/apollographql/router/security/advisories/GHSA-hff2-gcpx-8f4p', 'https://github.com/apollographql/router/commit/a72e759bcdeef93fcd3dc928cf3c1f4bbebdcc65', 'https://github.com/apollographql/router', 'https://github.com/apollographql/router/releases/tag/v2.12.1', 'https://www.apollographql.com/docs/graphos/resources/runtime-release-lifecycle#end-of-support-eos'] | fbbee283272c0f750725314a98f360b4a64d28befe08f28761cfb42afc54ad36 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-35711 | cargo | cargo/arc-swap | Dangling reference in `access::Map` with Constant | An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map. | >=0.4.2 <0.4.8||>=1.0.0 <1.1.0 | ['0.4.8', '1.1.0'] | ['CVE-2020-35711', 'GHSA-9pqx-g3jh-qpqq'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35711', 'https://github.com/advisories/GHSA-9pqx-g3jh-qpqq', 'https://github.com/vorner/arc-swap/issues/45', 'https://github.com/vorner/arc-swap', 'https://rustsec.org/advisories/RUSTSEC-2020-0091.html'] | 45ca33d6f6f68360886cd80c836fb24c37c54339566638a8db886755d4e440a3 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2026-33693 | cargo | cargo/activitypub_federation | Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() | The `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. | <0.7.0-beta.9 | ['0.7.0-beta.9'] | ['CVE-2026-33693', 'GHSA-q537-8fr5-cw35'] | ['https://nvd.nist.gov/vuln/detail/CVE-2026-33693', 'https://github.com/advisories/GHSA-q537-8fr5-cw35', 'https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35', 'https://github.com/LemmyNet/activitypub-federation-rust/commit/4ae8532b17bc35755240b7f55d4a5b7665351599', 'https://github.com/LemmyNet/activitypub-federation-rust', 'https://github.com/advisories/GHSA-7723-35v7-qcxw'] | db3dd89a4a6a25a53a6295d7663614a484bf184e82d8c21a394aa918c2687bdc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-7723-35v7-qcxw | cargo | cargo/activitypub_federation | Duplicate | This advisory duplicates another. | <0 | ['GHSA-7723-35v7-qcxw'] | ['https://github.com/advisories/GHSA-7723-35v7-qcxw', 'https://github.com/LemmyNet/lemmy/security/advisories/GHSA-7723-35v7-qcxw', 'https://github.com/LemmyNet/activitypub-federation-rust'] | 37f53a78c45b93d2f4c2cbc751b6cd4060ea7e54dd430696b0e075c44127694e | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-84m6-5m72-45fp | cargo | cargo/apollo-router | Duplicate | This advisory duplicates another. | <0 | ['GHSA-84m6-5m72-45fp'] | ['https://github.com/advisories/GHSA-84m6-5m72-45fp', 'https://github.com/apollographql/router/security/advisories/GHSA-84m6-5m72-45fp', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | 78bd6c0862dda0d5a02476d19b10eec40c8e46bd2cd3e117f931a6af745609d1 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2021-29930 | cargo | cargo/arenavec | Out of bounds write in arenavec | An issue was discovered in the arenavec crate through 0.1.1. A drop of uninitialized memory can sometimes occur upon a panic in T::default() | <=0.1.1 | ['CVE-2021-29930', 'GHSA-327x-39hh-65wf'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-29930', 'https://github.com/advisories/GHSA-327x-39hh-65wf', 'https://github.com/ibabushkin/arenavec/issues/1', 'https://github.com/ibabushkin/arenavec', 'https://rustsec.org/advisories/RUSTSEC-2021-0040.html'] | 58e39525cc8e4f9682de1476181f195788684627113c7c5c07908bd7ba2479db | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2021-29931 | cargo | cargo/arenavec | Double free in arenavec | Affected versions of this crate did not guard against potential panics that may happen from user-provided functions T::default() and T::drop().
Panic within T::default() leads to dropping uninitialized T, when it is invoked from common::Slice::<T, H>::new(). Panic within T::drop() leads to double drop of T, when it is invoked either from common::SliceVec::<T, H>::resize_with() or common::SliceVec::<T, H>::resize()
Either case causes memory corruption in the heap memory. | <=0.1.1 | ['CVE-2021-29931', 'GHSA-955p-rc5h-hg6h'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-29931', 'https://github.com/advisories/GHSA-955p-rc5h-hg6h', 'https://github.com/ibabushkin/arenavec/issues/1', 'https://github.com/ibabushkin/arenavec', 'https://rustsec.org/advisories/RUSTSEC-2021-0040.html'] | 68f6a12822de49d26cd5c72d59b29cddecd1c88f2791307dde01c0c8f25a973f | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-3632-54q8-m96x | cargo | cargo/arenavec | arenavec has multiple memory corruption vulnerabilities in safe APIs | The crate has the following vulnerabilities:
- The public trait `arenavec::common::AllocHandle` allows the return of raw pointers through its methods `allocate` and `allocate_or_extend`. However, the trait is not marked as unsafe, meaning users of the crate may implement it under the assumption that the library safely handles the returned raw pointers. These raw pointers can later be dereferenced within safe APIs of the crate-such as `arenavec::common::SliceVec::push`-potentially leading to arbitrary memory access.
- The safe API `arenavec::common::SliceVec::reserve` can reach the private function `arenavec::common::allocate_inner`. Incorrect behavior in `allocate_inner` may result in a `SliceVec` with an increased capacity, even though the underlying memory has not actually been expanded. This mismatch between `SliceVec.capacity` and the actual reserved memory can lead to a heap buffer overflow.
- The safe API `arenavec::common::SliceVec::split_off` can duplicate the ownership of the elements in `self` (of type `SliceVec`) if they implement the `Drop` trait. Specifically, when `at == 0`, the method returns a new `SliceVec` with the same length as `self`. Since both `self` and the returned object point to the same heap memory, dropping one will deallocate the shared memory. When the other is subsequently dropped, it will attempt to free the same memory again, resulting in a double free violation. | <=0.1.1 | ['GHSA-3632-54q8-m96x'] | ['https://github.com/advisories/GHSA-3632-54q8-m96x', 'https://github.com/ibabushkin/arenavec/issues/4', 'https://github.com/ibabushkin/arenavec/issues/5', 'https://github.com/ibabushkin/arenavec/issues/6', 'https://github.com/ibabushkin/arenavec', 'https://rustsec.org/advisories/RUSTSEC-2025-0053.html'] | d4305a069281ad21fb5985cb523fe3ebee01583bde94f84da194b356c325a12c | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2022-39397 | cargo | cargo/aliyun-oss-client | Leak in Aliyun KeySecret | Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally. | <0.8.1 | ['0.8.1'] | ['CVE-2022-39397', 'GHSA-3w3h-7xgx-grwc'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-39397', 'https://github.com/advisories/GHSA-3w3h-7xgx-grwc', 'https://github.com/tu6ge/oss-rs/security/advisories/GHSA-3w3h-7xgx-grwc', 'https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29', 'https://github.com/tu6ge/oss-rs', 'https://rustsec.org/advisories/RUSTSEC-2022-0089.html'] | aad76e9c8856607cae787db18fc6ad9fe262983a2684b2a798575c83f3c1db4c | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-mm7x-qfjj-5g2c | cargo | cargo/ammonia | Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal | Affected versions of this crate did not correctly strip namespace-incompatible tags
in certain situations, causing it to incorrectly account for differences between HTML,
SVG, and MathML.
This vulnerability only has an effect when the `svg` or `math` tag is allowed,
because it relies on a tag being parsed as html during the cleaning process, but
serialized in a way that causes in to be parsed as xml by the browser.
Additionally, the application using this library must allow a tag that is parsed as raw text in HTML.
These [elements] are:
* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script
Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default. | >=4.1.0 <4.1.2||>=4.0.0 <4.0.1||<3.3.1 | ['4.1.2', '4.0.1', '3.3.1'] | ['GHSA-mm7x-qfjj-5g2c'] | ['https://github.com/advisories/GHSA-mm7x-qfjj-5g2c', 'https://github.com/rust-ammonia/ammonia/commit/de0297111a3a1273275b670960bcd47a0481718e', 'https://github.com/rust-ammonia/ammonia', 'https://rustsec.org/advisories/RUSTSEC-2025-0071.html'] | 4a722a4c4b4b6d3d7732b1576a6b3696cc06042d2a244b36c51edd288219b0c2 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-35886 | cargo | cargo/arr | Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr | arr crate contains multiple security issues. Specifically,
1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
2. Index and IndexMut implementation does not check the array bound.
3. Array::new_from_template() drops uninitialized memory. | <=0.6.1 | ['CVE-2020-35886', 'GHSA-c7fw-cr3w-wvfc'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35886', 'https://github.com/advisories/GHSA-c7fw-cr3w-wvfc', 'https://github.com/sjep/array/issues/1', 'https://github.com/sjep/array', 'https://rustsec.org/advisories/RUSTSEC-2020-0034.html'] | 724e5b9683e9271af2daab01c351dd55560209d288de7ac693111dbbfadbc2a9 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2020-35887 | cargo | cargo/arr | Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr | arr crate contains multiple security issues. Specifically,
1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
2. Index and IndexMut implementation does not check the array bound.
3. Array::new_from_template() drops uninitialized memory. | <=0.6.1 | ['CVE-2020-35887', 'GHSA-fhvj-7f9p-w788'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35887', 'https://github.com/advisories/GHSA-fhvj-7f9p-w788', 'https://github.com/sjep/array/issues/1', 'https://github.com/sjep/array', 'https://rustsec.org/advisories/RUSTSEC-2020-0034.html'] | d610e74f8f19fb3847c114c7ea881a1f9ff6bdf9b83f5583939c64bae2dc31e4 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2020-35888 | cargo | cargo/arr | Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr | arr crate contains multiple security issues. Specifically,
1. It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
2. Index and IndexMut implementation does not check the array bound.
3. Array::new_from_template() drops uninitialized memory. | <=0.6.1 | ['CVE-2020-35888', 'GHSA-36xw-hgfv-jwm7'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35888', 'https://github.com/advisories/GHSA-36xw-hgfv-jwm7', 'https://github.com/sjep/array/issues/1', 'https://github.com/sjep/array', 'https://rustsec.org/advisories/RUSTSEC-2020-0034.html'] | ecc92b74dd3f5000817c765bdcdf01f2f0dd57c6b88c348d56ac557b03d46e95 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-67r5-rqwv-9p9q | cargo | cargo/array-init-cursor | array-init-cursor is unsound when used with types that implement `Drop` | The `Drop` implementation will get run twice when using the cursor.
This issue does not affect you, if you are using only using the crate with types that are `Copy` such as `u8`.
This issue also does not affect you, if you are only depending on it through the crate `planus`. | <0.2.1 | ['0.2.1'] | ['GHSA-67r5-rqwv-9p9q'] | ['https://github.com/advisories/GHSA-67r5-rqwv-9p9q', 'https://github.com/planus-org/planus/issues/293', 'https://github.com/planus-org/planus/pull/294', 'https://github.com/planus-org/planus', 'https://rustsec.org/advisories/RUSTSEC-2025-0019.html'] | c50a213b672d36ef0b39f1f988d7b8272ce8504739884a6caa6f049d119520e4 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-8215 | npm | npm/canvas | Buffer Overflow | A buffer overflow is present in canvas version which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image. | <=1.6.9 | ['1.6.10'] | ['CVE-2020-8215'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-8215'] | 0e3bb544a5a215b878afee0492d971d8245d3843c709b76df19d27b962a63b46 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-27814 | cargo | cargo/Simple-Wayland-HotKey-Daemon | Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon | SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. | <1.2.0 | ['1.2.0'] | ['CVE-2022-27814', 'GHSA-x446-3xhq-5xfp'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-27814', 'https://github.com/advisories/GHSA-x446-3xhq-5xfp', 'https://github.com/waycrate/swhkd', 'https://github.com/waycrate/swhkd/releases', 'https://github.com/waycrate/swhkd/releases/tag/1.2.0', 'https://www.openwall.com/lists/oss-security/2022/04/14/1'] | c775a4131513a2cefc5ce76dea610cc50e1ac4c712592a48a380df5d681e4fe3 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2023-41317 | cargo | cargo/apollo-router | Apollo Router Unnamed "Subscription" operation results in Denial-of-Service | This is a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when GraphQL Subscriptions are enabled. It can be triggered when **all of the following conditions are met**: | >=1.28.0 <1.29.1 | ['1.29.1'] | ['CVE-2023-41317', 'GHSA-w8vq-3hf9-xppx'] | ['https://nvd.nist.gov/vuln/detail/CVE-2023-41317', 'https://github.com/advisories/GHSA-w8vq-3hf9-xppx', 'https://github.com/apollographql/router/security/advisories/GHSA-w8vq-3hf9-xppx', 'https://github.com/apollographql/router/commit/b295c103dd86c57c848397d32e8094edfa8502aa', 'https://github.com/apollographql/router', 'https://github.com/apollographql/router/releases/tag/v1.29.1'] | 1783a77520a168dc24391b72fe068cd01c4a880b8be7f2a1c7fb70b81196f437 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-83gg-pwxf-jr89 | cargo | cargo/array-macro | `array!` macro is unsound in presence of traits that implement methods it calls internally | Affected versions of this crate called some methods using auto-ref. The affected code looked like this.
```rust
let mut arr = $crate::__core::mem::MaybeUninit::uninit();
let mut vec = $crate::__ArrayVec::<T>::new(arr.as_mut_ptr() as *mut T);
```
In this case, the problem is that `as_mut_ptr` is a method of `&mut MaybeUninit`, not `MaybeUninit`. This made it possible for traits to hijack the method calls in order to cause unsoundness.
```rust
trait AsMutPtr<T> {
fn as_mut_ptr(&self) -> *mut T;
}
impl<T> AsMutPtr<T> for std::mem::MaybeUninit<T> {
fn as_mut_ptr(&self) -> *mut T {
std::ptr::null_mut()
}
}
array![0; 1];
```
The flaw was corrected by explicitly referencing variables in macro body in order to avoid auto-ref. | >=0.1.2 <1.0.5 | ['1.0.5'] | ['GHSA-83gg-pwxf-jr89'] | ['https://github.com/advisories/GHSA-83gg-pwxf-jr89', 'https://github.com/xfix/array-macro/commit/01940637dd8f3bfeeee3faf9639fa9ae52f19f4d', 'https://github.com/rustsec/advisory-db/blob/main/crates/array-macro/RUSTSEC-2020-0161.md', 'https://github.com/xfix/array-macro', 'https://gitlab.com/KonradBorowski/array-macro/-/commit/01940637dd8f3bfeeee3faf9639fa9ae52f19f4d', 'https://rustsec.org/advisories/RUSTSEC-2020-0161.html'] | 69de344fab3011c5962ce340cc88f9f77dfc805619d00196416b0bfca3d9b8dc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36452 | cargo | cargo/array-tools | Memory corruption in array-tools | An issue was discovered in the array-tools crate before 0.3.2 for Rust. Affected versions of this crate don't guard against panics, so that partially uninitialized buffer is dropped when user-provided `T::clone()` panics in `FixedCapacityDequeLike<T, A>::clone()`. This causes memory corruption. | <0.3.2 | ['0.3.2'] | ['CVE-2020-36452', 'GHSA-6wp2-fw3v-mfmc'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36452', 'https://github.com/advisories/GHSA-6wp2-fw3v-mfmc', 'https://github.com/L117/array-tools/issues/2', 'https://github.com/L117/array-tools', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/array-tools/RUSTSEC-2020-0132.md', 'https://rustsec.org/advisories/RUSTSEC-2020-0132.html'] | 2cddfbfc410e550f248d63bbb849d6954cde850b0155a1365d01d42e4a3e859f | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
MAL-2025-47394 | npm | npm/capacitor-notificationhandler | Malicious code in capacitor-notificationhandler (npm) | This package was compromised by the Shai-Hulud NPM worm.
The malicious payload steals tokens and credentials and publishes
them to GitHub before propogating itself to NPM packages the user owns. | >=0.0.2 <=0.0.3||=0.0.2||=0.0.3 | ['MAL-2025-47394', 'GHSA-xmrh-mcq6-h3x8'] | ['https://github.com/advisories/MAL-2025-47394', 'https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack', 'https://semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/', 'https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again', 'https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised', 'https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages', 'https://github.com/advisories/GHSA-xmrh-mcq6-h3x8'] | 29872d5d90f79789941548807a6e0e92e2f37a769bf3845c9891b8f8aae2eb4a | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-8v2v-wjwg-vx6r | cargo | cargo/actix-files | actix-files has a possible exposure of information vulnerability | When passing a non-existing folder to the `actix_files::Files::new()` method causes the actix server to expose unexpected files. | <0.6.10 | ['0.6.10'] | ['GHSA-8v2v-wjwg-vx6r'] | ['https://github.com/advisories/GHSA-8v2v-wjwg-vx6r', 'https://github.com/actix/actix-web/security/advisories/GHSA-8v2v-wjwg-vx6r', 'https://github.com/actix/actix-web', 'https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L104', 'https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L38', 'https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/files.rs#L98', 'https://github.com/actix/actix-web/blob/fba766b4beb92278665d58815c94d336015225c5/actix-files/src/service.rs#L136'] | e1c87bd664c4d100407801296331170693c1a244adac3f6a1f0af606fb62abfe | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-gcqf-3g44-vc9p | cargo | cargo/actix-files | [actix-files] Panic triggered by empty Range header in GET request for static file | A GET request for a static file served by `actix-files` with an empty `Range` header triggers a panic. With `panic = "abort"`, a remote user may crash the process on-demand. | <0.6.10 | ['0.6.10'] | ['GHSA-gcqf-3g44-vc9p'] | ['https://github.com/advisories/GHSA-gcqf-3g44-vc9p', 'https://github.com/actix/actix-web/security/advisories/GHSA-gcqf-3g44-vc9p', 'https://github.com/actix/actix-web', 'https://github.com/actix/actix-web/blob/0383f4bdd1210e726143ca1ebcf01169b67a4b6c/actix-files/src/named.rs#L530-L535'] | 753cd25d01e5d6f8fbdca6a2d278413e839eab302c83bfaa5ff9d8a17ec2e065 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-35901 | cargo | cargo/actix-http | Use-after-free in actix-http | An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream. | <2.0.0 | ['2.0.0'] | ['CVE-2020-35901', 'GHSA-v3j6-xf77-8r9c'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35901', 'https://github.com/advisories/GHSA-v3j6-xf77-8r9c', 'https://github.com/actix/actix-web/issues/1321', 'https://github.com/actix/actix-web', 'https://rustsec.org/advisories/RUSTSEC-2020-0048.html'] | 2356a96e43c0cc4ab5042f7ca29e083171afef8e2a7c0c7d019072ad92e151b1 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-p2g9-94wh-65c2 | cargo | cargo/ammonia | Space bug in `clean_text` | An incorrect mapping from HTML specification to ASCII codes was used.
Because HTML treats the Form Feed as whitespace, code like this has an injection bug:
let html = format!("<div title={}>", clean_text(user_supplied_string));
Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all. | >=3.0.0 <3.1.3 | ['3.1.3'] | ['GHSA-p2g9-94wh-65c2'] | ['https://github.com/advisories/GHSA-p2g9-94wh-65c2', 'https://github.com/rust-ammonia/ammonia/pull/147', 'https://github.com/rust-ammonia/ammonia/commit/6c7bf22907a75d1bbaed52e4f7dd9716f5e6f737', 'https://github.com/rust-ammonia/ammonia', 'https://rustsec.org/advisories/RUSTSEC-2022-0003.html'] | 95778b57f6de6656a85c5f1b822cec307170807382e17f134670798f0659bc2d | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-27815 | cargo | cargo/Simple-Wayland-HotKey-Daemon | Insecure Temporary File in SWHKD | SWHKD is a display protocol-independent hotkey daemon made in Rust. In SWHKD versions 1.1.5 and prior, SWHKD uses the /tmp/swhkd.pid pathname. As /tmp is accessible to all users, there can be an information leak or denial of service. No known workarounds exist. A patch is available on the `1.1.0` branch of the repository. | <1.2.0 | ['1.2.0'] | ['CVE-2022-27815', 'GHSA-p4jg-pccf-h82c'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-27815', 'https://github.com/advisories/GHSA-p4jg-pccf-h82c', 'https://github.com/waycrate/swhkd/commit/e661a4940df78fbb7b52c622ac4ae6a3a7f7d8aa', 'https://github.com/waycrate/swhkd', 'https://github.com/waycrate/swhkd/releases', 'https://github.com/waycrate/swhkd/releases/tag/1.2.0'] | e11d55e2bc783e2d79865e8e972bb1704de39e9ff3768be0c17a937e0b022f04 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-27816 | cargo | cargo/Simple-Wayland-HotKey-Daemon | Data Loss/Denial of Service in SWHKD | SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. A patch is available on the `1.1.0` branch of the repository. | <1.2.0 | ['1.2.0'] | ['CVE-2022-27816', 'GHSA-8m49-2xj8-67v9'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-27816', 'https://github.com/advisories/GHSA-8m49-2xj8-67v9', 'https://github.com/waycrate/swhkd/commit/0b620a09605afb815c6d8d8953bbb7a10a8c0575', 'https://github.com/waycrate/swhkd', 'https://github.com/waycrate/swhkd/releases/tag/1.2.0'] | 4fa4c9b2e1829334d95ea19e36cd0d1d8db5828f423537c0e51cdde661c5d267 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-27817 | cargo | cargo/Simple-Wayland-HotKey-Daemon | Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon | SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality. | <=1.1.5 | ['CVE-2022-27817', 'GHSA-h5wh-7h2j-h999'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-27817', 'https://github.com/advisories/GHSA-h5wh-7h2j-h999', 'https://github.com/waycrate/swhkd', 'https://github.com/waycrate/swhkd/releases', 'https://www.openwall.com/lists/oss-security/2022/04/14/1'] | c26437bba861b1580aa7f76250a4e48fc548390232ddac379bdcf9646ef0b06d | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2025-62370 | cargo | cargo/alloy-dyn-abi | alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing | An uncaught panic triggered by malformed input to `alloy_dyn_abi::TypedData` could lead to a denial-of-service (DoS) via `eip712_signing_hash()`.
Software with high availability requirements such as network services may be particularly impacted. If in use, external auto-restarting mechanisms can partially mitigate the availability issues unless repeated attacks are possible. | <0.8.26||>=1.0.0 <1.4.1 | ['0.8.26', '1.4.1'] | ['CVE-2025-62370', 'GHSA-pgp9-98jm-wwq2'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-62370', 'https://github.com/advisories/GHSA-pgp9-98jm-wwq2', 'https://github.com/alloy-rs/core/security/advisories/GHSA-pgp9-98jm-wwq2', 'https://crates.io/crates/alloy-dyn-abi/0.8.26', 'https://crates.io/crates/alloy-dyn-abi/1.4.1', 'https://github.com/alloy-rs/core', 'https://rustsec.org/advisories/RUSTSEC-2025-0073.html'] | 7c14264ea6faed639787bbca1da7b84aa637501bf4e10343c58e619a9004f00b | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2021-38193 | cargo | cargo/ammonia | Cross-site Scripting in ammonia | An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870. | >=3.0.0 <3.1.0||<2.1.3 | ['3.1.0', '2.1.3'] | ['CVE-2021-38193', 'GHSA-5325-xw5m-phm3'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-38193', 'https://github.com/advisories/GHSA-5325-xw5m-phm3', 'https://github.com/rust-ammonia/ammonia/pull/142', 'https://github.com/rust-ammonia/ammonia', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ammonia/RUSTSEC-2021-0074.md', 'https://rustsec.org/advisories/RUSTSEC-2021-0074.html'] | d82e279ef2e7ac8b5d1a3a71d115d47fba8af61c80cea46b3fe5721f5b4efea2 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2026-45137 | cargo | cargo/anchor-lang | Anchor: Program<'info, System> is not properly validated | An logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions. | >=1.0.0 <1.0.2 | ['1.0.2'] | ['CVE-2026-45137', 'GHSA-c6rc-8jpp-2fgc'] | ['https://nvd.nist.gov/vuln/detail/CVE-2026-45137', 'https://github.com/advisories/GHSA-c6rc-8jpp-2fgc', 'https://github.com/solana-foundation/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc', 'https://github.com/solana-foundation/anchor/releases/tag/v1.0.2', 'https://github.com/otter-sec/anchor/security/advisories/GHSA-c6rc-8jpp-2fgc', 'https://rustsec.org/advisories/RUSTSEC-2026-0144.html'] | e51f540ad109ae3f4fddfa7f7c0f8e0cef0e65c0b2066e1d439f6ed30af074d0 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-35724 | cargo | cargo/apache-avro | Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU | It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. | <0.14.0 | ['0.14.0'] | ['CVE-2022-35724', 'GHSA-v456-chpw-6mmw'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-35724', 'https://github.com/advisories/GHSA-v456-chpw-6mmw', 'https://github.com/a0x8o/avro', 'https://lists.apache.org/thread/771z1nwrpkn1ovmyfb2fm65mchdxgy7p'] | 55e89a25738e46b2570cb0d280b646b77506f408a5c7113714a170c1ff86d5bc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-32380 | cargo | cargo/apollo-router | Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing | A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service. | <1.61.2||>=2.0.0-alpha.0 <2.1.1 | ['1.61.2', '2.1.1'] | ['CVE-2025-32380', 'GHSA-3j43-9v8v-cp3f'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-32380', 'https://github.com/advisories/GHSA-3j43-9v8v-cp3f', 'https://github.com/apollographql/router/security/advisories/GHSA-3j43-9v8v-cp3f', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | 675952b9809e37c849206258451faa7bad00f01a52fa8f9d7ffc0b9fe2cad5c1 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-27818 | cargo | cargo/Simple-Wayland-HotKey-Daemon | Insecure temporary file usage in SWHKD | SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service. | <1.2.0 | ['1.2.0'] | ['CVE-2022-27818', 'GHSA-r3r5-jhw6-4634'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-27818', 'https://github.com/advisories/GHSA-r3r5-jhw6-4634', 'https://github.com/waycrate/swhkd/commit/f70b99dd575fab79d8a942111a6980431f006818', 'https://github.com/waycrate/swhkd', 'https://github.com/waycrate/swhkd/releases/tag/1.2.0'] | 70e462b49d5debdb46f3511d9d046655c5e20be7d4efa83fc54f19cab2e3d08d | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-27819 | cargo | cargo/Simple-Wayland-HotKey-Daemon | Unsafe parsing in SWHKD | SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device). | <1.2.0 | ['1.2.0'] | ['CVE-2022-27819', 'GHSA-h6xw-mghq-7523'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-27819', 'https://github.com/advisories/GHSA-h6xw-mghq-7523', 'https://github.com/waycrate/swhkd/commit/b4e6dc76f4845ab03104187a42ac6d1bbc1e0021', 'https://github.com/waycrate/swhkd', 'https://github.com/waycrate/swhkd/releases', 'https://github.com/waycrate/swhkd/releases/tag/1.2.0'] | 51689b1412d7d954d6a6bf6d5f48bcda3a52d29b67b5208a985fc74b5ad1b085 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-vhj5-x93p-67jw | cargo | cargo/actix-web-lab | actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects | `actix-web-lab` redirect middleware uses request-derived host information to construct absolute redirect URLs (for example, `https://{hostname}{path}`). In deployments without strict host allowlisting, an attacker can supply a malicious Host header and poison the `Location` response header, causing open redirect/phishing behavior. | <0.26.0 | ['0.26.0'] | ['GHSA-vhj5-x93p-67jw'] | ['https://github.com/advisories/GHSA-vhj5-x93p-67jw', 'https://github.com/robjtede/actix-web-lab/security/advisories/GHSA-vhj5-x93p-67jw', 'https://github.com/robjtede/actix-web-lab/pull/292', 'https://github.com/robjtede/actix-web-lab/commit/142c28b82eb59b67445a859a2a9b75e01a9964ee', 'https://github.com/robjtede/actix-web-lab'] | 8a04c1e95de432be5526a5ffa5b88120550feda316ed5c0796434134d1672824 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2026-32766 | cargo | cargo/astral-tokio-tar | astral-tokio-tar insufficiently validates PAX extensions during extraction | In versions 0.5.6 and earlier of astral-tokio-tar, malformed PAX extensions were silently skipped when parsing tar archives. This silent skipping (rather than rejection) of invalid PAX extensions could be used as a building block for a parser differential, for example by having astral-tokio-tar silently skip a malformed GNU “long link” extension so that a subsequent parser would misinterpret the extension.
In practice, exploiting this behavior in astral-tokio-tar requires a secondary misbehaving tar parser, i.e. one that insufficiently validates malformed PAX extensions and interprets them rather than skipping or erroring on them. Consequently this advisory is considered low-severity within astral-tokio-tar itself, as it requires a separate vulnerability against any unrelated tar parser. | <0.6.0 | ['0.6.0'] | ['CVE-2026-32766', 'GHSA-6gx3-4362-rf54'] | ['https://nvd.nist.gov/vuln/detail/CVE-2026-32766', 'https://github.com/advisories/GHSA-6gx3-4362-rf54', 'https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-6gx3-4362-rf54', 'https://github.com/astral-sh/tokio-tar/commit/e5e0139cae4577eeedf5fc16b65e690bf988ce52', 'https://rustsec.org/advisories/RUSTSEC-2026-0066.html'] | 6b75bb992f6d63b8f131fd1a51cc1e59a26b30ddc01abd61374f61570b8e0dcf | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-xx64-wwv2-hcqq | cargo | cargo/astral-tokio-tar | astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks | In versions 0.6.0 and earlier of astral-tokio-tar, the `unpack_in` API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.
See GHSA-j4xf-2g29-59ph for the equivalent flaw in the `tar` crate. | <0.6.1 | ['0.6.1'] | ['GHSA-xx64-wwv2-hcqq'] | ['https://github.com/advisories/GHSA-xx64-wwv2-hcqq', 'https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-xx64-wwv2-hcqq', 'https://rustsec.org/advisories/RUSTSEC-2026-0113.html'] | cdb3fe86928ae6e8797f95ff1140da837901d80f19904a0e6a88c8bb36859fd8 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2018-25025 | cargo | cargo/actix-web | Out-of-bounds Write in actix-web | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption. | <0.7.19 | ['0.7.19'] | ['CVE-2018-25025', 'GHSA-fgfm-hqjw-3265'] | ['https://nvd.nist.gov/vuln/detail/CVE-2018-25025', 'https://github.com/advisories/GHSA-fgfm-hqjw-3265', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md', 'https://rustsec.org/advisories/RUSTSEC-2018-0019.html', 'https://github.com/actix/actix-web/issues/289'] | 40acb8c74b512d9c4fa2de3a5c4dca09eadeb2ee33fc0f5101c8101f65483b00 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2018-25026 | cargo | cargo/actix-web | Out-of-bounds Write in actix-web | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption. | <0.7.19 | ['0.7.19'] | ['CVE-2018-25026', 'GHSA-7x36-h62w-vw65'] | ['https://nvd.nist.gov/vuln/detail/CVE-2018-25026', 'https://github.com/advisories/GHSA-7x36-h62w-vw65', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md', 'https://rustsec.org/advisories/RUSTSEC-2018-0019.html', 'https://github.com/actix/actix-web/issues/289'] | eda84cedef28f8bcac71fb84429af8d0e3ddd99d41a28b9677f7cba81ef10d28 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-32032 | cargo | cargo/apollo-router | Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass | A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. This could lead to excessive resource consumption and denial of service. | <1.61.2||>=2.0.0-alpha.0 <2.1.1 | ['1.61.2', '2.1.1'] | ['CVE-2025-32032', 'GHSA-94hh-jmq8-2fgp'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-32032', 'https://github.com/advisories/GHSA-94hh-jmq8-2fgp', 'https://github.com/apollographql/router/security/advisories/GHSA-94hh-jmq8-2fgp', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | 94b80cae7f30b9efdbe91bba6306cb5d6295394952b1820621629566145e314f | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-f5v5-ccqc-6w36 | cargo | cargo/async-nats | async-nats vulnerable to TLS certificate common name validation bypass | The NATS official Rust clients are vulnerable to MitM when using TLS.
The common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with the `host` field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it. | <0.29.0 | ['0.29.0'] | ['GHSA-f5v5-ccqc-6w36'] | ['https://github.com/advisories/GHSA-f5v5-ccqc-6w36', 'https://github.com/nats-io/nats.rs/commit/817a7b942c462fa9d9938dcb62124173634132fb#diff-767d442397fcaaf2f83e8f924d4a70317a2ce4703a49964d6007707949cfa5f5L303-R304', 'https://github.com/nats-io/nats.rs', 'https://rustsec.org/advisories/RUSTSEC-2023-0027.html'] | ca90b45213bbdd9d53ba885cf49f315c9b787c875a110dcf3acb10028ef2d61b | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-w65j-g6c7-g3m4 | cargo | cargo/actix-web | Multiple memory safety issues in actix-web | Affected versions contain multiple memory safety issues, such as:
- Unsoundly coercing immutable references to mutable references
- Unsoundly extending lifetimes of strings
- Adding the `Send` marker trait to objects that cannot be safely sent between threads
This may result in a variety of memory corruption scenarios, most likely use-after-free.
A signficant refactoring effort has been conducted to resolve these issues. | <0.7.19 | ['0.7.19'] | ['GHSA-w65j-g6c7-g3m4'] | ['https://github.com/advisories/GHSA-w65j-g6c7-g3m4', 'https://github.com/actix/actix-web/issues/289', 'https://rustsec.org/advisories/RUSTSEC-2018-0019.html'] | b1bb210747fea52cc0203ef515bded9526db20af4ccf78e9a82a9f9edb94770e | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-31496 | cargo | cargo/apollo-compiler | Apollo Compiler Named Fragment Processing Vulnerability | A vulnerability in Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This could lead to excessive resource consumption and denial of service in applications. | <1.27.0 | ['1.27.0'] | ['CVE-2025-31496', 'GHSA-7mpv-9xg6-5r79'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-31496', 'https://github.com/advisories/GHSA-7mpv-9xg6-5r79', 'https://github.com/apollographql/apollo-rs/security/advisories/GHSA-7mpv-9xg6-5r79', 'https://github.com/apollographql/apollo-rs/pull/952', 'https://github.com/apollographql/apollo-rs'] | 876bb62165b9c172ef4bea8ca62896d0120bc1c7f7bb44d7138593f230fb656e | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2023-45812 | cargo | cargo/apollo-router | Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions | The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic.
To be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. | >=1.31.0 <1.33.0 | ['1.33.0'] | ['CVE-2023-45812', 'GHSA-r344-xw3p-2frj'] | ['https://nvd.nist.gov/vuln/detail/CVE-2023-45812', 'https://github.com/advisories/GHSA-r344-xw3p-2frj', 'https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj', 'https://github.com/apollographql/router/issues/4013', 'https://github.com/apollographql/router/pull/4014', 'https://github.com/apollographql/router/commit/b917b8c117b46a2d508428c0856f4927dfcfc341', 'https://github.com/apollographql/router'] | 4335767b7d6a91fca4ba39b57f179a35f302e54e60e84c43bbb0d7703f81047d | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-3227-r97m-8j95 | cargo | cargo/afire | Relative Path Traversal in afire serve_static | This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible. | >=0.2.1 <1.1.0 | ['1.1.0'] | ['GHSA-3227-r97m-8j95'] | ['https://github.com/advisories/GHSA-3227-r97m-8j95', 'https://github.com/Basicprogrammer10/afire/security/advisories/GHSA-3227-r97m-8j95', 'https://github.com/Basicprogrammer10/afire/commit/da7904c04f82e1cb43cc42eaf6a1dba072b5c921', 'https://github.com/Basicprogrammer10/afire', 'https://github.com/Basicprogrammer10/afire/releases/tag/v1.1.0'] | 41441daf2790f49733ab98fba22967e0aba8061ca9ce37f90a5b307ed0ade278 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36432 | cargo | cargo/alg_ds | Use of Uninitialized Resource in alg_ds | An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. `Matrix::new()` internally calls `Matrix::fill_with()` which uses `*ptr = value` pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct. | <=0.3.1 | ['CVE-2020-36432', 'GHSA-3vv3-frrq-6486'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36432', 'https://github.com/advisories/GHSA-3vv3-frrq-6486', 'https://gitlab.com/dvshapkin/alg-ds', 'https://gitlab.com/dvshapkin/alg-ds/-/issues/1', 'https://rustsec.org/advisories/RUSTSEC-2020-0033.html'] | b04142fa724a948a6e87f665d64c7f00a97698792728b41374737a9306da5fa9 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2021-31996 | cargo | cargo/algorithmica | Double free in algorithmica | An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation, simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs. | <=0.1.8 | ['CVE-2021-31996', 'GHSA-jh37-772x-4hpw'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-31996', 'https://github.com/advisories/GHSA-jh37-772x-4hpw', 'https://github.com/AbrarNitk/algorithmica/issues/1', 'https://rustsec.org/advisories/RUSTSEC-2021-0053.html'] | 2127350d098f55c87d75daa2ed93117a6e010f83f2ce307af160e251c615d3bd | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-75m2-jhh5-j5g2 | cargo | cargo/apollo-router | Duplicate | This advisory duplicates another. | <0 | ['GHSA-75m2-jhh5-j5g2'] | ['https://github.com/advisories/GHSA-75m2-jhh5-j5g2', 'https://github.com/apollographql/router/security/advisories/GHSA-75m2-jhh5-j5g2', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | e945b7bf3bf07495aaf49df51d8093236fd9e4aaef07f48097f46092399b03f8 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2016-10615 | npm | npm/curses | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | curses is bindings for the native curses library, a full featured console IO library. curses downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. | <=0.0.10 | ['GHSA-8p52-7cxv-6c95', 'CVE-2016-10615'] | ['https://nvd.nist.gov/vuln/detail/CVE-2016-10615', 'https://github.com/advisories/GHSA-8p52-7cxv-6c95', 'https://www.npmjs.com/advisories/215', 'https://nodesecurity.io/advisories/215'] | 749b63a1d25dd7263b2f6a4143b572becd23628e3e13007b6492dd8bb85e9b91 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2024-8418 | cargo | cargo/aardvark-dns | Missing connection timeout in Aardvark-dns | A flaw was found in Aardvark-dns versions 1.12.0 and 1.12.1. They contain a denial of service vulnerability due to serial processing of TCP DNS queries. This flaw allows a malicious client to keep a TCP connection open indefinitely, causing other DNS queries to time out and resulting in a denial of service for all other containers using aardvark-dns. | >=1.12.0 <1.12.2 | ['1.12.2'] | ['CVE-2024-8418', 'GHSA-g5jh-57wm-p79m'] | ['https://nvd.nist.gov/vuln/detail/CVE-2024-8418', 'https://github.com/advisories/GHSA-g5jh-57wm-p79m', 'https://github.com/containers/aardvark-dns/issues/500', 'https://github.com/containers/aardvark-dns/pull/503', 'https://github.com/containers/aardvark-dns/commit/aa109bbd6743abd7027e589cc4b871dd2dce7d50', 'https://access.redhat.com/errata/RHSA-2025:7094', 'https://access.redhat.com/security/cve/CVE-2024-8418', 'https://bugzilla.redhat.com/show_bug.cgi?id=2309683', 'https://github.com/containers/aardvark-dns'] | 112d948fc851de4647cf25b49cc2ff545d094b76dfc6eee87e1b794fb15ed400 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36212 | cargo | cargo/abi_stable | Update unsound DrainFilter and RString::retain | An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop. | <0.9.1 | ['0.9.1'] | ['CVE-2020-36212', 'GHSA-vq23-5h4f-vwpv'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36212', 'https://github.com/advisories/GHSA-vq23-5h4f-vwpv', 'https://github.com/rodrimati1992/abi_stable_crates/issues/44', 'https://rustsec.org/advisories/RUSTSEC-2020-0105.html'] | f9843454dd8dee7fea51f5d908ca4422061a0b858e799fb3155f1a4a54a19c3b | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36213 | cargo | cargo/abi_stable | Update unsound DrainFilter and RString::retain | An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness. | <0.9.1 | ['0.9.1'] | ['CVE-2020-36213', 'GHSA-wqxc-qrq4-w5v4'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36213', 'https://github.com/advisories/GHSA-wqxc-qrq4-w5v4', 'https://github.com/rodrimati1992/abi_stable_crates/issues/44', 'https://rustsec.org/advisories/RUSTSEC-2020-0105.html'] | 41a7529fe167fb90541851fe7e332d9f59b8527b7b0a535be097d0b2a8baa424 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2021-45708 | cargo | cargo/abomonation | Abomonation transmutes &T to and from &[u8] without sufficient constraints | An issue was discovered in the abomonation crate through version 0.7.3 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass. | <=0.7.3 | ['CVE-2021-45708', 'GHSA-5vwc-r48g-wj6c'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-45708', 'https://github.com/advisories/GHSA-5vwc-r48g-wj6c', 'https://github.com/TimelyDataflow/abomonation/issues/23', 'https://github.com/TimelyDataflow/abomonation', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abomonation/RUSTSEC-2021-0120.md', 'https://rustsec.org/advisories/RUSTSEC-2021-0120.html'] | 41e56ee525dd62eb4b27904f0552d355ad30bfa4186170bdd1fa10931fb8f9c8 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-hfxp-p695-629x | cargo | cargo/abomonation | abomonation transmutes &T to and from &[u8] without sufficient constraints | This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri.
The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a repr(Rust) type is stable.
This transmute can also disclose both the contents of padding bytes which may be an information leak and the contents of pointers, which may be used to defeat ASLR. | <=0.7.3 | ['GHSA-hfxp-p695-629x'] | ['https://github.com/advisories/GHSA-hfxp-p695-629x', 'https://github.com/TimelyDataflow/abomonation/issues/23', 'https://github.com/TimelyDataflow/abomonation', 'https://rustsec.org/advisories/RUSTSEC-2021-0120.html'] | 1e7f473df4c6b4c272c350eee55a91890dfc39b32e614a4ca0fd50e756cbe0ca | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2021-38512 | cargo | cargo/actix-http | HTTP Request Smuggling in actix-http | Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling (HRS) attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also vulnerable.
Popular front-end proxies and load balancers already mitigate HRS attacks so it is recommended that they are also kept up to date; check your specific set up. You should upgrade even if the front-end proxy receives exclusively HTTP/2 traffic and connects to the back-end using HTTP/1; several downgrade attacks are known that can also expose HRS vulnerabilities. | <2.2.1 | ['2.2.1'] | ['CVE-2021-38512', 'GHSA-8928-2fgm-6x9x'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-38512', 'https://github.com/advisories/GHSA-8928-2fgm-6x9x', 'https://github.com/actix/actix-web/pull/2363', 'https://github.com/actix/actix-web/commit/e965d8298f421e9c89fe98b1300b8361e948c324', 'https://github.com/actix/actix-web', 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/67URRW4K47SR6LNQB4YALPLGGQMQK7HO', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-http/RUSTSEC-2021-0081.md', 'https://rustsec.org/advisories/RUSTSEC-2021-0081.html'] | 46c3d6a8199c7cb70331a3bb0f727aa7bce78f4ff1ec144289f7c8fa8df16479 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-35899 | cargo | cargo/actix-service | Use after free in actix-service | An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. | <1.0.6 | ['1.0.6'] | ['CVE-2020-35899', 'GHSA-whc7-5p35-4ww2'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35899', 'https://github.com/advisories/GHSA-whc7-5p35-4ww2', 'https://github.com/actix/actix-net/pull/158', 'https://github.com/actix/actix-net/commit/a67e38b4a07c92a3c81fa833f9eb1e91e74e39b7', 'https://github.com/actix/actix-net', 'https://rustsec.org/advisories/RUSTSEC-2020-0046.html'] | 0d2e472fbd87389509c9ba2f2b02bb568c00cfdaf8b0775d5c4e9aac0f67205a | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-35898 | cargo | cargo/actix-utils | Use after free in actix-utils | An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data. | <2.0.0 | ['2.0.0'] | ['CVE-2020-35898', 'GHSA-hhw2-pqhf-vmx2'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35898', 'https://github.com/advisories/GHSA-hhw2-pqhf-vmx2', 'https://github.com/actix/actix-net/issues/160', 'https://github.com/actix/actix-net/commit/0dca1a705ad1ff4885b3491ecb809a808e1de66c', 'https://github.com/actix/actix-net', 'https://rustsec.org/advisories/RUSTSEC-2020-0045.html'] | 5179ea9dd1b5b75dbf80f73530b02e854c12c7b633c80cc17c53317758d49413 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2018-25024 | cargo | cargo/actix-web | Out-of-bounds Write in actix-web | An issue was discovered in the actix-web crate before 0.7.19 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption. | <0.7.19 | ['0.7.19'] | ['CVE-2018-25024', 'GHSA-9qj6-4rfq-vm84'] | ['https://nvd.nist.gov/vuln/detail/CVE-2018-25024', 'https://github.com/advisories/GHSA-9qj6-4rfq-vm84', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/actix-web/RUSTSEC-2018-0019.md', 'https://rustsec.org/advisories/RUSTSEC-2018-0019.html', 'https://github.com/actix/actix-web/issues/289'] | 9bbf1698078b4f6b0ddc40901c31e85e6d858852f637782484dcdc69f7ec99cc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2021-38187 | cargo | cargo/anymap | Incorrect cast in anymap | An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64. | <=0.12.1 | ['CVE-2021-38187', 'GHSA-hc92-9h3m-c39j'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-38187', 'https://github.com/advisories/GHSA-hc92-9h3m-c39j', 'https://github.com/chris-morgan/anymap/issues/37', 'https://github.com/chris-morgan/anymap', 'https://rustsec.org/advisories/RUSTSEC-2021-0065.html'] | 035d3152829b416e2d396f2cb5dbeac5bd39b64f3dca923e25dcb34aff0d7cd2 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2025-64173 | cargo | cargo/apollo-router | Apollo Router Affected by an Access Control Bypass on Polymorphic Types | A vulnerability in Apollo Router allowed for unauthenticated queries to access data that required additional access controls. Router incorrectly handled access control directives on interface types/fields and their implementing object types/fields, applying them to interface types/fields while ignoring directives on their implementing object types/fields when all implementations had the same requirements. | <1.61.12||>=2.0.0-alpha.0 <2.8.1 | ['1.61.12', '2.8.1'] | ['CVE-2025-64173', 'GHSA-x33c-7c2v-mrj9'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-64173', 'https://github.com/advisories/GHSA-x33c-7c2v-mrj9', 'https://github.com/apollographql/router/security/advisories/GHSA-x33c-7c2v-mrj9', 'https://github.com/apollographql/router/commit/75ca43ecb9d38423b63d09896702f9da425cc754', 'https://github.com/apollographql/router'] | 4f1c72e19853c84b67e1e3107802737f1af7da101d5daab4e2b93e6b3c9b9bb1 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2019-15542 | cargo | cargo/ammonia | Uncontrolled recursion in ammonia | An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization. | <2.1.0 | ['2.1.0'] | ['CVE-2019-15542', 'GHSA-5hp8-35wj-m525'] | ['https://nvd.nist.gov/vuln/detail/CVE-2019-15542', 'https://github.com/advisories/GHSA-5hp8-35wj-m525', 'https://github.com/rust-ammonia/ammonia', 'https://github.com/rust-ammonia/ammonia/blob/master/CHANGELOG.md#210', 'https://rustsec.org/advisories/RUSTSEC-2019-0001.html'] | df47ae9db762ebdace618a46c3b81bd7443114037fcb79633a377ccf893f9213 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36441 | cargo | cargo/abox | Data race in abox | Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread. Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race). The flaw was corrected in commit `34c2b9e` by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`. | <0.4.1 | ['0.4.1'] | ['CVE-2020-36441', 'GHSA-r626-fc64-3q28'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36441', 'https://github.com/advisories/GHSA-r626-fc64-3q28', 'https://github.com/SonicFrog/abox/issues/1', 'https://github.com/SonicFrog/abox/pull/2', 'https://github.com/SonicFrog/abox/commit/34c2b9e', 'https://github.com/SonicFrog/abox', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/abox/RUSTSEC-2020-0121.md', 'https://rustsec.org/advisories/RUSTSEC-2020-0121.html'] | fb783089891ee1e1f045869533e93addb419c5328540004db5322d212ed2feaa | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36513 | cargo | cargo/acc_reader | Use of Uninitialized Resource in acc_reader. | An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations. | <=2.0.0 | ['CVE-2020-36513', 'GHSA-799f-r78p-gq9c'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36513', 'https://github.com/advisories/GHSA-799f-r78p-gq9c', 'https://github.com/netvl/acc_reader/issues/1', 'https://github.com/netvl/acc_reader', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md', 'https://rustsec.org/advisories/RUSTSEC-2020-0155.html'] | ec44c676c58494c04c57e19eadc1efd2b2abc76d2b2e368e26289d261802f32b | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2020-36514 | cargo | cargo/acc_reader | Use of Uninitialized Resource in acc_reader. | An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations. | <=2.0.0 | ['CVE-2020-36514', 'GHSA-p4cr-64x4-f92f'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36514', 'https://github.com/advisories/GHSA-p4cr-64x4-f92f', 'https://github.com/netvl/acc_reader/issues/1', 'https://github.com/netvl/acc_reader', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/acc_reader/RUSTSEC-2020-0155.md', 'https://rustsec.org/advisories/RUSTSEC-2020-0155.html'] | 937d32946fc4918f0f8e79799a832fbfda77848faead81bf52e9367e58897ec4 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-hv9v-7w3v-rj6f | cargo | cargo/acc_reader | `Read` on uninitialized buffer in `fill_buf()` and `read_up_to()` | Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.
Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior. | <=2.0.0 | ['GHSA-hv9v-7w3v-rj6f'] | ['https://github.com/advisories/GHSA-hv9v-7w3v-rj6f', 'https://github.com/netvl/acc_reader/issues/1', 'https://github.com/netvl/acc_reader', 'https://rustsec.org/advisories/RUSTSEC-2020-0155.html'] | 11d39b692c8b87dca990f0c4ed6a4ecb2187d02228f73978c64adffd56507da4 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2025-25194 | cargo | cargo/activitypub_federation | Server-Side Request Forgery (SSRF) in activitypub_federation | This vulnerability allows a user to bypass any predefined hardcoded URL path or security anti-Localhost mechanism and perform an arbitrary GET request to any Host, Port and URL using a Webfinger Request. | <=0.6.2 | ['CVE-2025-25194', 'GHSA-7723-35v7-qcxw'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-25194', 'https://github.com/advisories/GHSA-7723-35v7-qcxw', 'https://github.com/LemmyNet/lemmy/security/advisories/GHSA-7723-35v7-qcxw', 'https://github.com/LemmyNet/activitypub-federation-rust'] | 5bcb0c6c6bdfc6d84c4d84d4879f8f4a33ede5319fca622a71ba28a4041ee6bd | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2022-36124 | cargo | cargo/apache-avro | Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints | It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. | <0.14.0 | ['0.14.0'] | ['CVE-2022-36124', 'GHSA-wcm8-86x6-8mv3'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-36124', 'https://github.com/advisories/GHSA-wcm8-86x6-8mv3', 'https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo', 'https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2022-43180.yaml'] | e76e0edeb9d1524ce3c459d7c7d9a3dc7b97d3108c326cd7bf02b20bf8e6ceac | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2022-36125 | cargo | cargo/apache-avro | Apache Avro Rust SDK corrupted data read can cause crash | It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. | <0.14.0 | ['0.14.0'] | ['CVE-2022-36125', 'GHSA-3w5g-989p-35r8'] | ['https://nvd.nist.gov/vuln/detail/CVE-2022-36125', 'https://github.com/advisories/GHSA-3w5g-989p-35r8', 'https://github.com/a0x8o/avro', 'https://lists.apache.org/thread/t1r5xz0pvhm4tosqopjpj6dz8zlsht07'] | b5e3d7b87501fd8abac38da220822792ddaa7649faf260b4a785d503591c6d0d | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-xhj4-vrgc-hr34 | cargo | cargo/actix-http | actix-http has HTTP/1.1 CL.TE Request Smuggling | A vulnerability in `actix-http`'s HTTP/1.1 request parser allows an unauthenticated remote client to smuggle requests in deployments where a front-end HTTP intermediary and the Actix backend disagree about whether `Content-Length` or `Transfer-Encoding: chunked` defines the request body length. | <3.12.1 | ['3.12.1'] | ['GHSA-xhj4-vrgc-hr34'] | ['https://github.com/advisories/GHSA-xhj4-vrgc-hr34', 'https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34', 'https://github.com/actix/actix-web/releases/tag/http-v3.12.1', 'https://www.rfc-editor.org/rfc/rfc9112.html#name-message-body-length'] | 4f39f47ef3bdd3a095bf77043443377929e68076d8bb489e9853e11c4dce8d4a | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-7v4j-8wvr-v55r | cargo | cargo/array-macro | `array!` macro is unsound when its length is impure constant | Affected versions of this crate did substitute the array length provided by an user at compile-time multiple times.
When an impure constant expression is passed as an array length (such as a result of an impure procedural macro), this can result in the initialization of an array with uninitialized types, which in turn can allow an attacker to execute arbitrary code.
The flaw was corrected in commit [d5b63f72](https://github.com/xfix/array-macro/commit/d5b63f72090f3809c21ac28f9cfd84f12559bf7d) by making sure that array length is substituted just once. | >=2.1.0 <2.1.2 | ['2.1.2'] | ['GHSA-7v4j-8wvr-v55r'] | ['https://github.com/advisories/GHSA-7v4j-8wvr-v55r', 'https://github.com/xfix/array-macro/commit/d5b63f72090f3809c21ac28f9cfd84f12559bf7d', 'https://github.com/rustsec/advisory-db/blob/main/crates/array-macro/RUSTSEC-2022-0017.md', 'https://github.com/xfix/array-macro', 'https://gitlab.com/KonradBorowski/array-macro/-/issues/5', 'https://rustsec.org/advisories/RUSTSEC-2022-0017.html'] | e3eedc16f7324107ca0ac8a40371f8f3fb7d0b854469a35642b0b8936e512380 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-59825 | cargo | cargo/astral-tokio-tar | astral-tokio-tar has a path traversal in tar extraction | In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the `Entry::unpack_in_raw` API. Additionally, the `Entry::allow_external_symlinks` control (which defaults to `true`) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it.
These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution (e.g. by overwriting a file that the user or system then executes or uses to execute code).
The impact of this vulnerability for downstream API users of this crate is **high**, per above. However, for this crate's main downstream user (uv), the impact of this vulnerability is **low** due to its overlap with equivalent user capabilities in source distributions. See GHSA-7j9j-68r2-f35q for additional details. | <0.5.4 | ['0.5.4'] | ['CVE-2025-59825', 'GHSA-3wgq-wrwc-vqmv'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-59825', 'https://github.com/advisories/GHSA-3wgq-wrwc-vqmv', 'https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3wgq-wrwc-vqmv', 'https://github.com/google/security-research/security/advisories/GHSA-9p78-p5g6-gcj8', 'https://github.com/astral-sh/uv/issues/12163', 'https://github.com/astral-sh/tokio-tar/commit/036fdecc85c52458ace92dc9e02e9cef90684e75', 'https://github.com/astral-sh/tokio-tar'] | df6a63956c9130299bd579039bc5b5b26be9e798bfada3c63cc0c1d23449b5ac | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2021-29936 | cargo | cargo/adtensor | Free of uninitialized memory in adtensor | An issue was discovered in the adtensor crate through 0.0.3 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix. | <=0.0.3 | ['CVE-2021-29936', 'GHSA-rg4m-gww5-7p47'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-29936', 'https://github.com/advisories/GHSA-rg4m-gww5-7p47', 'https://github.com/charles-r-earp/adtensor/issues/4', 'https://github.com/charles-r-earp/adtensor', 'https://rustsec.org/advisories/RUSTSEC-2021-0045.html'] | 77f2cdf493afcfbde2297a2686eb8db309f2b35d7167c7d2792c1c7a18028a63 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2023-42811 | cargo | cargo/aes-gcm | AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure | In the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. | >=0.10.0 <0.10.3 | ['0.10.3'] | ['CVE-2023-42811', 'GHSA-423w-p2w9-r7vq'] | ['https://nvd.nist.gov/vuln/detail/CVE-2023-42811', 'https://github.com/advisories/GHSA-423w-p2w9-r7vq', 'https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq', 'https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309', 'https://github.com/RustCrypto/AEADs', 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K', 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU', 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF', 'https://rustsec.org/advisories/RUSTSEC-2023-0096.html'] | 2439162aa4c498b9817fe3fe95f99e894434e7a0acdf2989914ec53c61361da7 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2021-45688 | cargo | cargo/ash | Use of Uninitialized Resource in ash. | An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations. | <0.33.1 | ['0.33.1'] | ['CVE-2021-45688', 'GHSA-64wv-8vwp-xgw2'] | ['https://nvd.nist.gov/vuln/detail/CVE-2021-45688', 'https://github.com/advisories/GHSA-64wv-8vwp-xgw2', 'https://github.com/MaikKlein/ash/issues/354', 'https://github.com/ash-rs/ash/issues/354', 'https://github.com/ash-rs/ash/pull/470', 'https://github.com/ash-rs/ash/commit/2c98b6f384a017de031698bd623551a45f24c8f9', 'https://github.com/MaikKlein/ash', 'https://github.com/ash-rs/ash/compare/0.33.0...0.33.1', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ash/RUSTSEC-2021-0090.md', 'https://rustsec.org/advisories/RUSTSEC-2021-0090.html'] | fd22bed4e7ac2798e1d6861f02eed72364b0618b5a01928943ab6eea726ba5dd | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-8327-84cj-8xjm | cargo | cargo/alloy-json-abi | Stack overflow when parsing specially crafted JSON ABI strings | Affected versions of the `alloy-json-abi` crate did not properly handle parsing of malformatted JSON ABI strings. The `JsonAbi::parse` method can be tricked into a stack overflow when processing specially crafted input.
This stack overflow can lead to a crash of the application using this crate, potentially causing a denial of service.
The flaw was corrected in commit [4790c47](https://github.com/alloy-rs/core/commit/4790c47518024bd391bbd6815b00f501bad76a15). | <=0.7.7 | ['GHSA-8327-84cj-8xjm'] | ['https://github.com/advisories/GHSA-8327-84cj-8xjm', 'https://github.com/alloy-rs/core/issues/702', 'https://github.com/alloy-rs/core/commit/4790c47518024bd391bbd6815b00f501bad76a15', 'https://github.com/alloy-rs/core', 'https://rustsec.org/advisories/RUSTSEC-2024-0362.html'] | b09e3cfb1fc57ffa8f255bed7d9a9d6b70557e4158c1d44cbd849f77c4692d66 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2020-35885 | cargo | cargo/alpm-rs | Double free in alpm-rs | An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation. | <=0.1.24 | ['CVE-2020-35885', 'GHSA-qc4m-gc8r-mg8m'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-35885', 'https://github.com/advisories/GHSA-qc4m-gc8r-mg8m', 'https://github.com/pigeonhands/rust-arch/issues/2', 'https://github.com/BahNahNah/rust-arch/tree/master/alpm-rs', 'https://rustsec.org/advisories/RUSTSEC-2020-0032.html'] | cd5799a8fcaa9f8a78662a8a93d5c31e78c84b15874e5d91def879f1b0f692db | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2020-36469 | cargo | cargo/appendix | Data races in appendix | The `appendix` crate implements a key-value mapping data structure called
`Index<K, V>` that is stored on disk. The crate allows for any type to inhabit
the generic `K` and `V` type parameters and implements Send and Sync for them
unconditionally.
Using a type that is not marked as `Send` or `Sync` with `Index` can allow it
to be used across multiple threads leading to data races. Additionally using
reference types for the keys or values will lead to the segmentation faults
in the crate's code. | <=0.2.0 | ['CVE-2020-36469', 'GHSA-fvhr-7j8m-3cvc'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36469', 'https://github.com/advisories/GHSA-fvhr-7j8m-3cvc', 'https://github.com/krl/appendix/issues/6', 'https://github.com/krl/appendix', 'https://rustsec.org/advisories/RUSTSEC-2020-0149.html'] | 8a550c268b687e3448345169f4b6662542ca649393e89508960921d5d05449f9 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2025-27498 | cargo | cargo/ascon_aead | AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure | In `decrypt_in_place_detached`, the decrypted ciphertext (which is the correct ciphertext) is exposed even if the tag is incorrect. | <0.4.3 | ['0.4.3'] | ['CVE-2025-27498', 'GHSA-r38m-44fw-h886'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-27498', 'https://github.com/advisories/GHSA-r38m-44fw-h886', 'https://github.com/RustCrypto/AEADs/security/advisories/GHSA-r38m-44fw-h886', 'https://github.com/RustCrypto/AEADs/commit/d1d749ba57e38e65b0e037cd744d0b17f7254037', 'https://github.com/RustCrypto/AEADs'] | 3ac7f2322cbcb930cfea3a7bdacb07b2a696e15fea2c121e2917bfd1fce91165 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-429q-fhh4-r6hj | cargo | cargo/anchor-lang | Anchor: `InterfaceAccount` allows account substitution between unexpected types | Any uses of `InterfaceAccount` allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type.
The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details. | >=1.0.0-rc.1 <1.0.0-rc.2 | ['1.0.0-rc.2'] | ['GHSA-429q-fhh4-r6hj'] | ['https://github.com/advisories/GHSA-429q-fhh4-r6hj', 'https://github.com/solana-foundation/anchor/security/advisories/GHSA-429q-fhh4-r6hj', 'https://github.com/solana-foundation/anchor/pull/3837', 'https://github.com/solana-foundation/anchor/pull/4139', 'https://github.com/solana-foundation/anchor/commit/26ef36968a62e28a1f028e7adae4806af30c747d', 'https://github.com/otter-sec/anchor/security/advisories/GHSA-429q-fhh4-r6hj', 'https://rustsec.org/advisories/RUSTSEC-2026-0146.html'] | 24187ce1848d2f3a232b1b0078083867efe2dab6b0bd6937ee8ecc2f6f7e882d | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-pr59-jjr4-gcf6 | cargo | cargo/anon-vec | anon-vec lacks sufficient checks in public API | The following functions in the anon-vec crate are unsound due to insufficient checks on their arguments::
- `AnonVec::get_ref()`
- `AnonVec::get_mut()`
- `AnonVec::remove_get()`
The crate was built as a learning project and is not being maintained. | <=0.1.1 | ['GHSA-pr59-jjr4-gcf6'] | ['https://github.com/advisories/GHSA-pr59-jjr4-gcf6', 'https://github.com/RylanYancey/anon-vec', 'https://rustsec.org/advisories/RUSTSEC-2025-0039.html'] | afc05b274632f33a435d82341eb0ee89dc3958b89d3ccc6bcaa0dc5e1bbdd84a | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-74w3-p89x-ffgh | cargo | cargo/ansi_term | ansi_term is Unmaintained | ## Withdrawn Advisory
This advisory has been withdrawn because it does not discuss a particular vulnerability in the code of `ansi_term`.
## Original Description
The maintainer has adviced this crate is deprecated and will not receive any maintenance.
The crate does not seem to have much dependencies and may or may not be ok to use as-is.
Last release seems to have been three years ago. | >=0 | ['GHSA-74w3-p89x-ffgh'] | ['https://github.com/advisories/GHSA-74w3-p89x-ffgh', 'https://github.com/ogham/rust-ansi-term/issues/72', 'https://github.com/ogham/rust-ansi-term', 'https://rustsec.org/advisories/RUSTSEC-2021-0139.html'] | bbb6fd3208f162c5b6bee2b8d6485e63cef5ff80345689ae181cddd84ef031bc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-2rxc-gjrp-vjhx | cargo | cargo/anstream | Unsoundness in anstream | When given a valid UTF8 string "ö\x1b😀", the function in crates/anstream/src/adapter/strip.rs will be confused. The UTF8 bytes are \xc3\xb6 then \x1b then \xf0\x9f\x98\x80.
When looping over "non-printable bytes" \x1b\xf0 will be considered as some non-printable sequence.
This will produce a broken str from the incorrectly segmented bytes via str::from_utf8_unchecked, and that should never happen.
Full credit goes to @Ralith who reviewed this code and asked @burakemir to follow up. | <0.6.8 | ['0.6.8'] | ['GHSA-2rxc-gjrp-vjhx'] | ['https://github.com/advisories/GHSA-2rxc-gjrp-vjhx', 'https://github.com/rust-cli/anstyle/issues/156', 'https://github.com/rust-cli/anstyle', 'https://rustsec.org/advisories/RUSTSEC-2024-0404.html'] | 01cb752723f6269623d236b3f0a072caa8c563c26c8b4ea4f5ddc654e18b37e8 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36207 | cargo | cargo/aovec | Data races in aovec | An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur. | <=1.1.0 | ['CVE-2020-36207', 'GHSA-g489-xrw3-3v8w'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36207', 'https://github.com/advisories/GHSA-g489-xrw3-3v8w', 'https://github.com/krl/aovec', 'https://rustsec.org/advisories/RUSTSEC-2020-0099.html'] | 7cd216398d21ee44f9dd014da89e5c8dfba373b3f1a61731521700cb0f15b2dc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-h588-76vg-prgj | cargo | cargo/arrow | `DecimalArray` does not perform bound checks on accessing values and offsets | `DecimalArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the lenght of the backing buffer is not a multiple of 16. | <6.4.0 | ['6.4.0'] | ['GHSA-h588-76vg-prgj'] | ['https://github.com/advisories/GHSA-h588-76vg-prgj', 'https://github.com/apache/arrow-rs/issues/775', 'https://github.com/apache/arrow-rs', 'https://rustsec.org/advisories/RUSTSEC-2021-0117.html'] | 2781c863e0ee266ab0e5fc72cd42175bcaaee1f3f6d0bc8c3fd6c051835c6a1a | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-qgrp-8f3v-q85p | cargo | cargo/arrow | `FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets | `FixedSizeBinaryArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code. | <6.4.0 | ['6.4.0'] | ['GHSA-qgrp-8f3v-q85p'] | ['https://github.com/advisories/GHSA-qgrp-8f3v-q85p', 'https://github.com/apache/arrow-rs/issues/774', 'https://github.com/apache/arrow-rs', 'https://rustsec.org/advisories/RUSTSEC-2021-0118.html'] | b859b215b3c6affc374c1b57742b9f5b6ab1d92e3db30f2518b80bc7962cbba1 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-fp55-jw48-c537 | cargo | cargo/astral-tokio-tar | astral-tokio-tar is Vulnerable to PAX Header Desynchronization | Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem.
See GHSA-j5gw-2vrg-8fgx for a similar desynchronization bug in astral-tokio-tar. | <0.6.1 | ['0.6.1'] | ['GHSA-fp55-jw48-c537'] | ['https://github.com/advisories/GHSA-fp55-jw48-c537', 'https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-fp55-jw48-c537', 'https://rustsec.org/advisories/RUSTSEC-2026-0112.html'] | 14fc53826e449a00674c1668d3af6bff9d33cba1b4c60b7fb158bbfa4d2da0d5 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2024-47614 | cargo | cargo/async-graphql | async-graphql Directive Overload | - Service Disruption: The server may become unresponsive or extremely slow, potentially leading to downtime.
- Resource Exhaustion: Excessive use of server resources, such as CPU and memory, could negatively impact other services running on the same infrastructure.
- User Experience Degradation: Users may experience delays or failures when accessing the service, which could lead to frustration and loss of trust in the service. | <7.0.10 | ['7.0.10'] | ['CVE-2024-47614', 'GHSA-5gc2-7c65-8fq8'] | ['https://nvd.nist.gov/vuln/detail/CVE-2024-47614', 'https://github.com/advisories/GHSA-5gc2-7c65-8fq8', 'https://github.com/async-graphql/async-graphql/security/advisories/GHSA-5gc2-7c65-8fq8', 'https://github.com/async-graphql/async-graphql/commit/7f1791488463d4e9c5adcd543962173e2f6cbd34', 'https://github.com/async-graphql/async-graphql'] | 2cfa4f3a0112a7558a337c0907ce78d7293b329f896a571d0c859af23d5bb1fc | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2024-28101 | cargo | cargo/apollo-router | Apollo Router's Compressed Payloads do not respect HTTP Payload Limits | The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the `limits.http_max_request_bytes` configuration option after the entirety of the compressed payload is decompressed. If affected versions of the Router receive highly compressed payloads, this could result in significant memory consumption while the compressed payload is expanded. | >=0.9.5 <1.40.2 | ['1.40.2'] | ['CVE-2024-28101', 'GHSA-cgqf-3cq5-wvcj'] | ['https://nvd.nist.gov/vuln/detail/CVE-2024-28101', 'https://github.com/advisories/GHSA-cgqf-3cq5-wvcj', 'https://github.com/apollographql/router/security/advisories/GHSA-cgqf-3cq5-wvcj', 'https://github.com/apollographql/router/commit/9e9527c73c8f34fc8438b09066163cd42520f413', 'https://github.com/apollographql/router'] | 7b2d69c4266150cf51b054aa845e45988de942d69c9970591fb55aaca2178695 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2024-32971 | cargo | cargo/apollo-router | Apollo Router vulnerable to Critical Regression In Query Plan Cache | Any instance of Apollo Router 1.44.0 or 1.45.0 that is using Distributed Query Plan Caching is impacted. These versions were released on 2024-04-12 and 2024-04-22 respectively.
The affected versions of Apollo Router contain a bug that could lead to unexpected operations being executed, which can result in unintended data or effects. This only affects Router instances configured to use distributed query plan caching. Router versions other than the ones listed above, and all Router deployments that are not using distributed query plan caching, are unaffected by this defect.
If you are using the affected versions, you can check your router’s configuration YAML to verify if you are impacted:
```yaml
supergraph:
query_planning:
cache: | >=1.44.0 <1.45.1 | ['1.45.1'] | ['CVE-2024-32971', 'GHSA-q9p4-hw9m-fj2v'] | ['https://nvd.nist.gov/vuln/detail/CVE-2024-32971', 'https://github.com/advisories/GHSA-q9p4-hw9m-fj2v', 'https://github.com/apollographql/router/security/advisories/GHSA-q9p4-hw9m-fj2v', 'https://github.com/apollographql/router/commit/ff9f666598cd17661880fe7fc6e9c9611316e529', 'https://github.com/apollographql/router', 'https://github.com/apollographql/router/releases/tag/v1.45.1', 'https://www.apollographql.com/docs/router/configuration/distributed-caching/#distributed-query-plan-caching'] | 7ab8a3fe7e28bbfba8af38754ed5f5c188aa104b816ca50c0733ac66b88dc73e | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2025-32033 | cargo | cargo/apollo-router | Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow | A vulnerability in Apollo Router allowed certain queries to bypass configured operation limits, specifically due to integer overflow. | <1.61.2||>=2.0.0-alpha.0 <2.1.1 | ['1.61.2', '2.1.1'] | ['CVE-2025-32033', 'GHSA-84m6-5m72-45fp'] | ['https://nvd.nist.gov/vuln/detail/CVE-2025-32033', 'https://github.com/advisories/GHSA-84m6-5m72-45fp', 'https://github.com/apollographql/router/security/advisories/GHSA-84m6-5m72-45fp', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | d1165c8938a09ab886e6e1fc344d0119622b6f9e1f18280878420c69d97cc779 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
GHSA-xqjr-wfx3-gmxv | cargo | cargo/array-queue | ArrayQueue's push_front is not panic-safe | The safe API `array_queue::ArrayQueue::push_front` can lead to deallocating uninitialized memory if a panic occurs while invoking the `clone` method on the passed argument.
Specifically, `push_front` receives an argument that is intended to be cloned and pushed, whose type implements the `Clone` trait. Furthermore, the method updates the queue's `start` index before initializing the slot for the newly pushed element. User-defined implementations of `Clone` may include a `clone` method that can panic. If such a panic occurs during initialization, the structure is left with an advanced `start` index pointing to an uninitialized slot. When `ArrayQueue` is later dropped, its destructor treats that slot as initialized and attempts to drop it, resulting in an attempt to free uninitialized memory.
The bug was fixed in commit `728fe1b`. | >=0.3.0 <0.4.0 | ['0.4.0'] | ['GHSA-xqjr-wfx3-gmxv'] | ['https://github.com/advisories/GHSA-xqjr-wfx3-gmxv', 'https://github.com/raviqqe/array-queue/issues/3', 'https://github.com/raviqqe/array-queue/commit/728fe1bdffb04896d218e962d989a2ae6bf1ea92', 'https://github.com/raviqqe/array-queue', 'https://rustsec.org/advisories/RUSTSEC-2025-0054.html'] | 3a76d13e7439ce9649bb0f60ba38908abc662363ab8eaee7d15ae7022e59c3cf | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36444 | cargo | cargo/async-coap | Data races in async-coap | An issue was discovered in the async-coap crate through 2020-12-08 for Rust.
Affected versions of this crate implement Send/Sync for `ArcGuard<RC, T>` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads.
This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard<T>` in another thread that didn't lock its mutex). | <=0.1.0 | ['CVE-2020-36444', 'GHSA-9j8q-m9x5-9g6j'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36444', 'https://github.com/advisories/GHSA-9j8q-m9x5-9g6j', 'https://github.com/google/rust-async-coap/issues/33', 'https://github.com/google/rust-async-coap', 'https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/async-coap/RUSTSEC-2020-0124.md', 'https://rustsec.org/advisories/RUSTSEC-2020-0124.html'] | f905b4a5c51ded712490d621b4ca9761a3519f0e205bfdc6405993343416b50b | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
GHSA-94hh-jmq8-2fgp | cargo | cargo/apollo-router | Duplicate | This advisory duplicates another. | <0 | ['GHSA-94hh-jmq8-2fgp'] | ['https://github.com/advisories/GHSA-94hh-jmq8-2fgp', 'https://github.com/apollographql/router/security/advisories/GHSA-94hh-jmq8-2fgp', 'https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564', 'https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952', 'https://github.com/apollographql/router'] | 4878fc7ad481bc4445871b050fc0b0fd7bc69052e23f571172778f52d266b635 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | ||||
CVE-2020-26281 | cargo | cargo/async-h1 | Async-h1 request smuggling possible with long unread bodies | This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications.
If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body.
One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request.
Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary. | <2.3.0 | ['2.3.0'] | ['CVE-2020-26281', 'GHSA-4vr9-8cjf-vf9c'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-26281', 'https://github.com/advisories/GHSA-4vr9-8cjf-vf9c', 'https://github.com/http-rs/async-h1/security/advisories/GHSA-4vr9-8cjf-vf9c', 'https://github.com/http-rs/async-h1', 'https://github.com/http-rs/async-h1/releases/tag/v2.3.0', 'https://rustsec.org/advisories/RUSTSEC-2020-0093.html'] | e08b12525c533f7930884efcb751bee972ef4974331a95b707e2cd6cc8788b62 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 | |||
CVE-2020-36219 | cargo | cargo/atomic-option | Data race in atomic-option | An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur. | <=0.1.2 | ['CVE-2020-36219', 'GHSA-8gf5-q9p9-wvmc'] | ['https://nvd.nist.gov/vuln/detail/CVE-2020-36219', 'https://github.com/advisories/GHSA-8gf5-q9p9-wvmc', 'https://github.com/reem/rust-atomic-option/issues/4', 'https://github.com/reem/rust-atomic-option', 'https://rustsec.org/advisories/RUSTSEC-2020-0113.html'] | 01fb14e59151de38323d5990197efa7c2a514041a0b024220d759abad6b4d6b1 | 2026-05-30 02:19:32.024687+03:00 | 2026-06-29 20:47:25.193342+03:00 |