crates.io sheets-diff vulnerabilities

Latest crates.io sheets-diff CVEs

Newest publication first

1. RUSTSEC-2026-0317 A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

   Published 2026-09-29

   Medium·CVSS 5.5

   Affected versions passed caller-supplied bytes to calamine's Xlsx::new without first checking that they were a ZIP archive. Xlsx::new tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.