{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "nostr",
        "purl": "pkg:cargo/nostr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.44.7"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The NIP-50 event-matching path searched event content with\n`slice::windows(search.len())`. An empty search string therefore called\n`slice::windows(0)`, which always panics instead of returning a match result.\n\nA remote client able to submit filters to an application using this matcher could\ntrigger the panic with an empty NIP-50 search value. This includes clients querying an\nSDK local relay. Depending on the application\u0027s panic configuration and task\nisolation, the crafted filter could terminate request processing, a runtime worker, or\nthe entire process, causing denial of service. No confidentiality or integrity impact\nis known.\n\nEmpty searches are now handled before the substring search, so the matcher returns a\ndefined result without constructing a zero-sized window or panicking.",
  "id": "RUSTSEC-2026-0230",
  "modified": "2026-08-02T17:56:20Z",
  "published": "2026-08-01T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/nostr"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0230.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nostrdevkit/nostr/commit/29182657bc54ac18564597e4414f08c3e4e9aa0a"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Empty NIP-50 search filters can panic"
}