RUSTSEC-2026-0480

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0480

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0480.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0480

Aliases

CVE-2026-40693
GHSA-gwf2-8595-qw97

Published

2026-11-10T12:00:00Z

Modified

2026-11-11T08:45:02Z

Severity

5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Panic on a GCP launch endorsement without TDX measurements

Details

GcpTdxHost::verify_launch_endorsement(), available with the host-gcp-tdx feature, read uefi_golden.tdx.measurements[0] without checking that the golden measurement contains a TDX measurement. If a launch endorsement's golden measurement had no TDX measurements, the call panicked with an index out of bounds instead of returning an error.

The panic is reached only after the endorsement's signing certificate and signature have been verified. Triggering it therefore requires a correctly signed endorsement that lacks TDX measurements.

Intel describes the issue as improper input validation and classifies it as denial of service, with a CVSS 4.0 base score of 5.7, in INTEL-SA-01520.

The flaw was corrected in #87, released in 0.2.0. The function now returns Error::ParseError when the TDX measurement structure is missing or empty.

Reported by Borys Tsyrulnikov.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tdx_workload_attestation

Package

Name: tdx_workload_attestation; View open source insights on deps.dev
Purl: pkg:cargo/tdx_workload_attestation

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.2.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "tdx_workload_attestation::gcp::GcpTdxHost::verify_launch_endorsement"
        ],
        "os": []
    }
}