Vendor
2,267 published CVES affecting crates.io, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first · page 1 of 40 · showing the latest 1,000
-= Per source details. Do not edit below this line.=- Source: amazon-inspector (f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63) basek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed get_data() routine polls Windows key states for alphanumeric...
-= Per source details. Do not edit below this line.=- Source: amazon-inspector (83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391) The crate ships two reachable async payloads — pub async fn dat in src/test.rs and pub async fn bs in src/parse.rs, both imported from...
KeyShares::from_backup_format (the Shamir backup share reader, public since 0.2.0, the crate's first release) accepted a share whose x coordinate is 0, and KeyShares::recover_private_key interpolates the shares at x = 0 to recover the key. At an x of 0 the interpolation answers t...
In version 0.11.1 and earlier of vodozemac, Ed25519PublicKey::from_base64() and Ed25519SecretKey::from_base64() panic on malformed input instead of returning an error, if the input decodes to 31 or 33 bytes instead of the expected 32 bytes. An attacker who can supply a key to an...
Signature::from_der read a DER-encoded ECDSA signature leniently. It read as the signature: the signature followed by other bytes; a sequence length shorter than its contents, or longer with bytes after them (a length byte with its high bit set among them); and an R or S preceded...
Transaction::from_json, for a document with no hex member, held each input's txid member as given. An input txid that is not 64 hex digits ("zz", "", 63 or 65 digits, characters that are not hex digits) answered Ok: source_txid and to_json gave the text back, while to_binary wrot...
Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data manipulati...
Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This resul...
Transaction::from_binary and Transaction::from_hex read one transaction from the front of their input, did not check that the input ended there, and kept the whole input as the transaction's cached serialization: to_binary, to_hex and id() then answered for bytes that are not the...
The lwd-uri-util crate exfiltrated SSH keys, AWS credentials, and other environmental metadata and secrets when any crate using it was built. The malicious crate had 8 versions published on 2026-11-09 approximately 12 hours before removal and had no evidence of actual usage. This...
-= Per source details. Do not edit below this line.=- Source: amazon-inspector (912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614) The crate's build.rs runs on every cargo build/check/test (and under rust-analyzer) and performs installer-side credential theft unrel...
gabby-types-sec attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-17, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks t...
env-test-guard attempted to exfiltrate credentials from the environment to an arbitrary URL. The malicious crate had 2 versions published on 2026-03-24 and 2026-03-25, approximately 8 months before removal, and had no evidence of actual usage. This crate had no dependencies on cr...
electrumd attempted to send telemetry from the build environment to an arbitrary URL. The malicious crate had 5 versions published on 2026-01-26, approximately 10 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Thanks to Bi...
webhook_commands attempted to send telemetry from the execution environment to an arbitrary URL. The malicious crate had 1 version published on 2026-02-13, approximately 9 months before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Tha...
Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a key-changing message in the same record, because Deframer::aligned does not enforce RFC 8446 record-boundary alignment. A peer or on-path attacker can pack a pla...
rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writ...
rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthenticated ServerHello. Attackers can answer one connection with a ServerHello selecting X25519, causing later C...
rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an input-selected large history window. Malicious peers can send a certificate with a five-byte Brotli header...
Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where derived Debug formatting of client session values exposes secret key material. Custom ClientSessionStore implementations that log Tls12ClientSessionValue or Tls13Clie...
Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows remote attackers to exhaust CPU through quadratic-time name compression. Attackers can send malicious DNS messages with many records that add many candidate lab...
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net before 0.26.1 contain an unbounded loop vulnerability in DnssecDnsHandle NSEC3 closest-encloser proof validation when the SOA owner is not an ancestor of the QNAME. Upstream attackers can return NoData or NXD...
The hickory-dns recursor in hickory-recursor 0.25.0-alpha.3 through 0.25.2 and hickory-resolver 0.26.0-alpha.1 before 0.26.2 iterates every out-of-bailiwick NS target lacking glue in a referral without any per-query work budget. Remote attackers can serve such referrals to force...
Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone contain...
Hickory DNS hickory-resolver 0.26.0-beta.1 before 0.26.2 contains an unbounded retry loop in NameServerPool::try_send, which re-queues truncated (TC) responses without checking the answering transport or counting iterations. A malicious authoritative server returning TC=1 on ever...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.