rustsec/advisory-db
1
0
Fork 0
mirror of https://github.com/rustsec/advisory-db.git synced 2026-07-22 01:06:54 -04:00
Code Issues Packages Projects Releases Wiki Activity
3,072 Commits 30 Branches 0 Tags
bump-admin
Commit Graph

3072 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirkjan Ochtman
23735beed0 ci: bump rustsec-admin commit 2026-07-17 11:29:06 +02:00
Dirkjan Ochtman
f8c65d8063 Use explicit links for usernames to avoid spam 2026-07-17 11:29:05 +02:00
djc
3f58e366dd Synchronize IDs (2026-07-17) 2026-07-17 10:34:50 +02:00
Michael Howell
dde14fd7a9 Add CVE and fix credit by request of reporter 2026-07-17 07:23:11 +02:00
Pat Hickey
9f3e138091 RUSTSEC-2026-0188: add alias to assigned CVE 
GitHub assigned CVE-2026-58494 to this security advisory after it was published.

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj#advisory-comment-242586
 2026-07-13 19:31:41 +02:00
djc
6e3286f4ef Assigned RUSTSEC-2026-0206 to rustybuzz 2026-07-12 09:10:54 +02:00
Stephen Walker-Weinshenker
872a36ae44 Update RUSTSEC-0000-0000.md 2026-07-12 08:25:52 +02:00
Stephen Walker-Weinshenker
82bb623db8 Update RUSTSEC-0000-0000.md 2026-07-12 08:25:52 +02:00
Stephen Walker-Weinshenker
f608c9134e Add unmaintained advisory for rustybuzz 2026-07-12 08:25:52 +02:00
djc
e20296422f Synchronize IDs (2026-07-11) 2026-07-11 08:12:16 +02:00
djc
1090288da7 Synchronize IDs (2026-07-09) 2026-07-09 08:36:22 +02:00
djc
5e319f8942 Assigned RUSTSEC-2026-0205 to scc 2026-07-07 11:15:02 +02:00
Evian-Zhang
14e88536b5 Add advisory for exception safety violation in scc Array::insert 2026-07-07 11:01:29 +02:00
LawnGnome
463f03a9c0 Assigned RUSTSEC-2026-0204 to crossbeam-epoch 2026-07-06 15:19:41 -07:00
Taiki Endo
b86f52d2f9 Add advisory for invalid pointer dereference in fmt::Pointer impl for 
crossbeam_epoch::{Atomic,Shared}
 2026-07-06 15:18:12 -07:00
dependabot[bot]
575d6923ad Bump actions/cache from 5.0.5 to 6.1.0 
Bumps [actions/cache](https://github.com/actions/cache) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](27d5ce7f10...55cc834586)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-06 16:34:03 +02:00
djc
1c0f2cf9ae Assigned RUSTSEC-2026-0203 to tree-sitter-perl-next 2026-07-06 11:08:34 +02:00
Pierre Pichot
703a5d19fa Add tree-sitter-perl-next unmaintained advisory (#3039) 
* Add tree-sitter-perl-next unmaintained advisory

* Wrong ID
 2026-07-06 11:06:20 +02:00
djc
03ea7ec793 Assigned RUSTSEC-2026-0202 to cxx 2026-07-05 10:34:37 +02:00
EvianZhang
37d79551b1 Add advisory for cxx let_cxx_string unsoundness (#3037) 2026-07-05 10:21:41 +02:00
djc
94d9bc1c6b Assigned RUSTSEC-2026-0201 to fulgur 2026-07-04 22:19:28 +02:00
mitsuru
0d38dd0548 Add advisory for fulgur: blank-page DoS via non-painting replaced elements 2026-07-04 22:04:46 +02:00
djc
3529059b41 Assigned RUSTSEC-2026-0200 to fulgur 2026-07-04 21:39:58 +02:00
mitsuru
be15bb0e1d Add advisory for fulgur: unbounded page slicing DoS 2026-07-04 21:30:47 +02:00
djc
4c90b5326e Assigned RUSTSEC-2026-0199 to bcrypt 2026-07-04 10:15:24 +02:00
MUHAMMED HUSSEIN
d1ac26f9f4 Add advisory for bcrypt panic regression (CVE candidate) 
Adds an advisory for the panic in bcrypt::verify on non-ASCII hash input,
fixed in bcrypt 0.19.2 (Keats/rust-bcrypt PR #103).

Affected: >= 0.19.0, < 0.19.2
Fixed: >= 0.19.2
 2026-07-04 10:10:54 +02:00
djc
a333f19f82 Assigned RUSTSEC-2026-0198 to error-stack 2026-07-03 16:33:41 +02:00
Tim Diekmann
ffac6cccf7 Add advisory for error-stack aliased mutable references in Report::frames_mut 2026-07-03 16:23:50 +02:00
djc
bcda40dd5b Assigned RUSTSEC-2026-0196 to cgmath, RUSTSEC-2026-0197 to cgmath 2026-07-03 15:44:38 +02:00
LemonJ
6943b7cdbd Add advisory for cgmath swap_columns 2026-07-03 15:37:26 +02:00
djc
9d7ae756b3 Synchronize IDs (2026-07-03) 2026-07-03 08:12:08 +02:00
djc
6cd8a86e08 Assigned RUSTSEC-2026-0195 to quick-xml 2026-07-02 10:52:02 +02:00
Qifan Zhang
8495a526ab Add advisory for quick-xml: unbounded namespace-declaration allocation (memory DoS) 
quick-xml < 0.41.0: `NsReader` calls `NamespaceResolver::push` before returning each Start/Empty event; push allocated one binding per xmlns declaration with no upper bound (~3x the tag's byte size), invisible to the caller. On untrusted XML, and with concurrent readers, this exhausts process memory (OOM). Fixed in 0.41.0 (tafia/quick-xml@7ca2526).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-02 10:19:02 +02:00
djc
6947ede93d Assigned RUSTSEC-2025-0166 to stackvector, RUSTSEC-2026-0194 to quick-xml 2026-07-02 09:59:25 +02:00
sisy2020
342ba49b53 Add advisory for stackvector public length field unsoundness (#3005) 
* Add advisory for stackvector public length field unsoundness

* Update stackvector advisory with fixed version
 2026-07-02 09:52:11 +02:00
Qifan Zhang
b20b0b5a1d Add advisory for quick-xml: quadratic attribute duplicate-check (CPU DoS) 
quick-xml < 0.41.0: the default duplicate-attribute-name check in the `Attributes` iterator scanned all previously seen names for every attribute, so a start tag with N distinct names cost O(N^2) byte comparisons -- a remote, unauthenticated CPU-exhaustion DoS on untrusted XML. Fixed in 0.41.0 (tafia/quick-xml#971).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-02 09:44:10 +02:00
Dirkjan Ochtman
4075127c03 ci: bump admin commit 2026-07-01 13:29:10 +02:00
Michael Howell
5354dd1f81 Add GHSA entry for ammonia 4.1.3, 4.0.2, and 3.3.2 2026-07-01 07:03:44 +02:00
djc
55aad29b2c Assigned RUSTSEC-2026-0193 to ammonia 2026-06-30 16:05:13 +02:00
Michael Howell
91389c7112 Update RUSTSEC-0000-0000.md 2026-06-30 16:03:53 +02:00
Michael Howell
3f2962d8de Ammonia 4.1.3, 4.0.2, 3.3.2 2026-06-30 16:03:53 +02:00
djc
1e3b508975 Synchronize IDs (2026-06-30) 2026-06-30 09:16:56 +02:00
djc
3225a3c20f Assigned RUSTSEC-2026-0192 to ttf-parser 2026-06-29 22:59:47 +02:00
joszamama
7c5d921606 Add unmaintained advisory for ttf-parser 2026-06-29 22:53:16 +02:00
djc
783d7db4ae Assigned RUSTSEC-2025-0165 to i_tree 2026-06-29 17:03:09 +02:00
sisy2020
14e8c01584 Add advisory for unsound unchecked node accessors in i_tree 2026-06-29 16:58:42 +02:00
dependabot[bot]
e5a638fba9 Bump actions/checkout from 6.0.3 to 7.0.0 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...9c091bb21b)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-29 16:55:58 +02:00
djc
31eb89f2d4 Assigned RUSTSEC-2026-0191 to solana_rbpf 2026-06-29 16:39:58 +02:00
LemonJ
77e44c273d Add advisory for solana_rbpf invoke_function 2026-06-29 16:38:35 +02:00
djc
81f0611834 Assigned RUSTSEC-2026-0190 to anyhow 2026-06-29 16:05:53 +02:00