Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 84 available sources using the dropdown above.
OSV Rustsec π¦ is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| rustsec-2026-0455 | Large-window Brotli bodies bypass decompression memory limits | 2026-11-06T12:00:00Z | 2026-11-06T15:34:32Z |
| rustsec-2026-0451 | Degraded secret zeroization capabilities | 2026-11-06T12:00:00Z | 2026-11-06T15:34:32Z |
| rustsec-2026-0448 | Unbounded decompression can exhaust memory and CPU resources | 2026-11-06T12:00:00Z | 2026-11-06T14:42:53Z |
| rustsec-2026-0447 | Compressed request bodies can exhaust memory before extractor limits apply | 2026-11-06T12:00:00Z | 2026-11-06T14:42:53Z |
| rustsec-2026-0446 | Request smuggling through malformed chunked request trailers | 2026-11-06T12:00:00Z | 2026-11-06T14:33:54Z |
| rustsec-2026-0445 | Degraded secret zeroization capabilities | 2026-11-06T12:00:00Z | 2026-11-06T14:33:54Z |
| rustsec-2026-0443 | Hidden file disclosure through Windows short names | 2026-11-06T12:00:00Z | 2026-11-06T14:33:54Z |
| rustsec-2026-0449 | `ocipkg` is unmaintained | 2026-11-05T12:00:00Z | 2026-11-06T14:42:53Z |
| rustsec-2026-0454 | Data race and double free via unsound `Send`/`Sync` in `reblessive` | 2026-11-03T12:00:00Z | 2026-11-06T15:34:32Z |
| rustsec-2026-0452 | Out-of-bounds read when decoding internal keys shorter than 16 bytes | 2026-11-03T12:00:00Z | 2026-11-06T15:34:32Z |
| rustsec-2026-0440 | `astral-tokio-tar` is unmaintained | 2026-11-03T12:00:00Z | 2026-11-05T08:50:49Z |
| rustsec-2026-0442 | Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads | 2026-11-02T12:00:00Z | 2026-11-05T08:50:49Z |
| rustsec-2026-0435 | Unbounded memory allocation in `thrift` binary protocol `read_bytes` | 2026-11-02T12:00:00Z | 2026-11-02T11:45:44Z |
| rustsec-2026-0431 | Unbounded memory allocation in `evtx` parsing a `.wevtcache` file | 2026-11-01T12:00:00Z | 2026-11-02T10:46:59Z |
| rustsec-2026-0430 | Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read) | 2026-11-01T12:00:00Z | 2026-11-02T10:46:59Z |
| rustsec-2026-0434 | `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip) | 2026-10-31T12:00:00Z | 2026-11-02T11:17:24Z |
| rustsec-2026-0432 | `codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service) | 2026-10-31T12:00:00Z | 2026-11-02T11:17:24Z |
| rustsec-2026-0450 | `ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal) | 2026-10-30T12:00:00Z | 2026-11-06T14:42:53Z |
| rustsec-2026-0428 | BLAKE2b produces wrong tag when using `reset()` with a different-length key | 2026-10-30T12:00:00Z | 2026-10-30T11:12:39Z |
| rustsec-2026-0426 | LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time | 2026-10-30T12:00:00Z | 2026-10-30T11:04:43Z |
| rustsec-2026-0425 | `nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal) | 2026-10-30T12:00:00Z | 2026-10-30T10:42:08Z |
| rustsec-2026-0427 | `sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip) | 2026-10-29T12:00:00Z | 2026-10-30T11:12:39Z |
| rustsec-2026-0424 | Unchecked memory usage in transferring borrowed resources between components | 2026-10-29T12:00:00Z | 2026-10-30T10:42:08Z |
| rustsec-2026-0423 | Cross-engine type confusion with host-created struct-types-with-supertypes | 2026-10-29T12:00:00Z | 2026-10-30T10:42:08Z |
| rustsec-2026-0422 | Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check | 2026-10-29T12:00:00Z | 2026-10-30T10:42:08Z |
| rustsec-2026-0421 | wasi-http p2: outgoing content-length can be invalid or not match body | 2026-10-29T12:00:00Z | 2026-10-30T10:42:08Z |
| rustsec-2026-0420 | wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving | 2026-10-29T12:00:00Z | 2026-10-30T10:42:08Z |
| rustsec-2026-0419 | Unbounded memory use on large request bodies | 2026-10-29T12:00:00Z | 2026-10-29T14:05:38Z |
| rustsec-2026-0436 | Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input | 2026-10-28T12:00:00Z | 2026-11-03T09:44:19Z |
| rustsec-2026-0433 | Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS` | 2026-10-28T12:00:00Z | 2026-11-02T11:17:24Z |