crates.io

RUSTSEC-2026-0344

crates.io/ruzstd

Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM) 2 days ago

Fix available
Severity - 7.5 (High)

RUSTSEC-2026-0335

crates.io/mykey

Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master... 4 days ago

Fix available
Severity - 9.1 (Critical)

RUSTSEC-2026-0336

crates.io/mykey

MIKEY message MAC is never verified on receive, so forged messages are accepted 4 days ago

Fix available
Severity - 7.5 (High)

RUSTSEC-2026-0337

crates.io/ic-cipher

Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes... 4 days ago

Fix available
Severity - 7.5 (High)

MAL-2026-17713

crates.io/sharpnes

Malicious code in sharpnes (crates.io) 5 days ago

No fix available

RUSTSEC-2026-0333

crates.io/noyalib

Resource budgets not enforced on the typed deserialization path 06 Oct

Fix available

GHSA-2cv4-cqwr-gwf7

PyPI/uv
crates.io/uv

uv: Path traversal on Windows through wheel extraction 05 Oct

Fix available
Severity - 5.9 (Medium)

GHSA-2mjx-qc3c-rqvc

crates.io/rustls

Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries 05 Oct

Fix available
Severity - 5.3 (Medium)

GHSA-6f2x-v7q7-m7m5

crates.io/hickory-resolver

hickory-resolver follows irrelevant CNAME records 05 Oct

Fix available
Severity - 6.9 (Medium)

GHSA-6w6g-hm98-mhgm

crates.io/hickory-resolver

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS) 05 Oct

Fix available
Severity - 8.7 (High)

GHSA-5j98-2g5x-46v6

crates.io/hickory-resolver

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures 05 Oct

Fix available
Severity - 7.5 (High)

GHSA-cjcg-cxmh-9wcr

crates.io/praxis-proxy

Praxis affected by HTTP/2 Bomb 02 Oct

Fix available
Severity - 7.5 (High)

GHSA-2hw9-mc66-jc2q

crates.io/wasmtime

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state 02 Oct

Fix available
Severity - 2.0 (Low)

GHSA-8ffr-xgwf-xj56

crates.io/aws-smithy-json

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers 02 Oct

Fix available
Severity - 8.7 (High)

GHSA-6g2r-675j-hx59

crates.io/xxhash-rust

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release 02 Oct

Fix available
Severity - 2.3 (Low)

GHSA-c9xm-49cp-xcr9

crates.io/rmcp

rmcp OAuth client fetches server-controlled resource_metadata URLs 02 Oct

Fix available
Severity - 6.3 (Medium)

Vulnerabilities