crates.io ring vulnerabilities

Latest crates.io ring CVEs

Newest publication first

1. CVE-2025-4432 Ring: some aes functions may panic when overflow checking is enabled in ring

   Published 2025-05-09

   Medium·CVSS 5.3 EPSS 1.0%

   A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets...

2. RUSTSEC-2025-0010 Versions of *ring* prior to 0.17 are unmaintained.

   Published 2025-03-05

   Unknown

   ring 0.16.20 was released over 4 years ago and isn't maintained, tested, etc. Additionally, the project's general policy is to only patch the latest release, which is 0.17.12 now. It will be difficult for anybody to backport future fixes to versions earlier than 0.17.10 due to li...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.