mirror of
https://github.com/rustsec/advisory-db.git
synced 2026-07-22 01:06:54 -04:00
2324 lines
82 KiB
XML
2324 lines
82 KiB
XML
<?xml version="1.0"?>
|
||
<feed xmlns="http://www.w3.org/2005/Atom"><title>RustSec Advisories</title><id>https://rustsec.org/feed.xml</id><updated>2026-07-03T12:00:00+00:00</updated><author><name>RustSec</name></author><icon>https://rustsec.org/favicon.ico</icon><link href="https://rustsec.org/feed.xml" rel="self" type="application/atom+xml"/><link href="https://rustsec.org/" rel="alternate" type="text/html"/><subtitle xml:lang="en">Security advisories filed against Rust crates</subtitle><entry><title>RUSTSEC-2026-0196: cgmath is unmaintained</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0196.html</id><updated>2026-07-03T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0196.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0196: cgmath is unmaintained"/><published>2026-07-03T12:00:00+00:00</published><summary xml:lang="en">`cgmath` is unmaintained</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/cgmath/RUSTSEC-2026-0196.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/cgmath/RUSTSEC-2026-0196.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0196">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0196
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>cgmath</code> is unmaintained</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-01">
|
||
July 1, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-03">
|
||
July 3, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/cgmath.html">cgmath</a>
|
||
|
||
(<a href="https://crates.io/crates/cgmath">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unmaintained
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/rustsec/advisory-db/pull/2910#pullrequestreview-4611570365">
|
||
https://github.com/rustsec/advisory-db/pull/2910#pullrequestreview-4611570365
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/rustgd/cgmath/issues/565">
|
||
https://github.com/rustgd/cgmath/issues/565
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The <code>cgmath</code> crate is no longer maintained.</p>
|
||
<p>Users should consider switching to a maintained alternative.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0197: Unsoundness in cgmath</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0197.html</id><updated>2026-07-03T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0197.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0197: Unsoundness in cgmath"/><published>2026-07-03T12:00:00+00:00</published><summary xml:lang="en">`Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/cgmath/RUSTSEC-2026-0197.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/cgmath/RUSTSEC-2026-0197.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0197">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0197
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>Matrix{2,3,4}::swap_columns</code> can trigger undefined behavior for identical indices</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-03-11">
|
||
March 11, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-03">
|
||
July 3, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/cgmath.html">cgmath</a>
|
||
|
||
(<a href="https://crates.io/crates/cgmath">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/soundness.html">#soundness</a>
|
||
|
||
<a href="/keywords/undefined-behavior.html">#undefined-behavior</a>
|
||
|
||
<a href="/keywords/aliasing.html">#aliasing</a>
|
||
|
||
<a href="/keywords/stacked-borrows.html">#stacked-borrows</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/rustgd/cgmath/issues/565">
|
||
https://github.com/rustgd/cgmath/issues/565
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>cgmath::Matrix2::swap_columns</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>=0.18.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><code>cgmath::Matrix3::swap_columns</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>=0.18.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><code>cgmath::Matrix4::swap_columns</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>=0.18.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The <code>Matrix2::swap_columns</code>, <code>Matrix3::swap_columns</code>, and <code>Matrix4::swap_columns</code>
|
||
implementations call <code>ptr::swap(&amp;mut self[a], &amp;mut self[b])</code>.</p>
|
||
<p>When <code>a == b</code>, these safe APIs create two mutable references to the same matrix
|
||
column and pass them to <code>ptr::swap</code>. This violates Rust's aliasing rules and can
|
||
trigger undefined behavior. The issue can be reproduced from safe Rust by calling
|
||
<code>swap_columns</code> with identical column indices, for example <code>m.swap_columns(0, 0)</code>.</p>
|
||
<p>A minimal fix is to return early when the two column indices are equal before
|
||
calling <code>ptr::swap</code>.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2025-0166: Unsoundness in stackvector</title><id>https://rustsec.org/advisories/RUSTSEC-2025-0166.html</id><updated>2026-07-02T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2025-0166.html" rel="alternate" type="text/html" title="RUSTSEC-2025-0166: Unsoundness in stackvector"/><published>2026-07-02T12:00:00+00:00</published><summary xml:lang="en">Multiple soundness issues in `stackvector`</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/stackvector/RUSTSEC-2025-0166.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/stackvector/RUSTSEC-2025-0166.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2025-0166">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2025-0166
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Multiple soundness issues in <code>stackvector</code></p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2025-10-23">
|
||
October 23, 2025
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-02">
|
||
July 2, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/stackvector.html">stackvector</a>
|
||
|
||
(<a href="https://crates.io/crates/stackvector">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/issues/3">
|
||
https://github.com/Alexhuszagh/rust-stackvector/issues/3
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/pull/6">
|
||
https://github.com/Alexhuszagh/rust-stackvector/pull/6
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357">
|
||
https://github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/issues/5">
|
||
https://github.com/Alexhuszagh/rust-stackvector/issues/5
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=2.0.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of <code>stackvector</code> contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.</p>
|
||
<p>One issue was that <code>StackVec::length</code> was exposed as a public field. Safe Rust code could set <code>length</code> to a value larger than the backing array capacity. Other safe methods, including <code>remove</code>, <code>pop</code>, and <code>truncate</code>, relied on <code>length</code> before performing unsafe pointer operations (<code>ptr::read</code>, <code>ptr::copy</code>, <code>offset</code>/<code>add</code>). If <code>length</code> was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.</p>
|
||
<p>The upstream maintainer also identified additional soundness issues, including the use of <code>mem::uninitialized</code> in <code>StackVec::from_vec_unchecked</code>, which was reachable through <code>from_vec</code>, and Miri violations related to <code>MaybeUninit</code> usage.</p>
|
||
<p>Version <code>2.0.0</code> was released to fix the known soundness issues.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0194: Vulnerability in quick-xml</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0194.html</id><updated>2026-07-02T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0194.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0194: Vulnerability in quick-xml"/><published>2026-07-02T12:00:00+00:00</published><summary xml:lang="en">Quadratic run time when checking a start tag for duplicate attribute names</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/quick-xml/RUSTSEC-2026-0194.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/quick-xml/RUSTSEC-2026-0194.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0194">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0194
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Quadratic run time when checking a start tag for duplicate attribute names</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-02">
|
||
July 2, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/quick-xml.html">quick-xml</a>
|
||
|
||
(<a href="https://crates.io/crates/quick-xml">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/xml.html">#xml</a>
|
||
|
||
<a href="/keywords/parser.html">#parser</a>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/algorithmic-complexity.html">#algorithmic-complexity</a>
|
||
|
||
<a href="/keywords/quadratic.html">#quadratic</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/issues/969">
|
||
https://github.com/tafia/quick-xml/issues/969
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/pull/971">
|
||
https://github.com/tafia/quick-xml/pull/971
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/commit/07f3db8343cf152f5bc3483ef5b3164582489bea">
|
||
https://github.com/tafia/quick-xml/commit/07f3db8343cf152f5bc3483ef5b3164582489bea
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.41.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>BytesStart::attributes()</code> returns an <code>Attributes</code> iterator which, by default
|
||
(<code>with_checks(true)</code>), rejects a start tag that repeats an attribute name. For
|
||
each attribute yielded, the iterator compared the new name against every name
|
||
seen so far in the same tag using a linear scan, so a start tag with <code>N</code>
|
||
distinct attribute names cost <code>O(N²)</code> byte comparisons. There was no bound on
|
||
<code>N</code> other than the size of the buffered start tag.</p>
|
||
<h2>Impact</h2>
|
||
<p>Any code that parses untrusted XML and iterates a start tag's attributes with
|
||
the default duplicate check enabled can be made to spend CPU time quadratic in
|
||
the number of attributes on a single tag. Because the check is pure computation
|
||
with no <code>.await</code>/I/O, an I/O-based timeout on the consumer (for example a read
|
||
or request timeout) cannot interrupt it while it runs.</p>
|
||
<p>Measured cost of a single start tag, release build:</p>
|
||
<p>| Attributes on one tag | Time |
|
||
|---|---|
|
||
| 80,000 | ~6 s |
|
||
| 800,000 | ~10 min |</p>
|
||
<p>The cost grows with the square of the attribute count, so a start tag of a few
|
||
tens of megabytes can stall a parsing thread for hours. No memory is exhausted
|
||
and the parser does not crash; the effect is CPU exhaustion on the thread doing
|
||
the parsing: a single crafted start tag can pin a CPU core for minutes to hours,
|
||
denying service to that worker. A deployment that places a wall-clock bound on
|
||
parsing, or confines it to a non-critical thread, may consider the availability
|
||
impact lower.</p>
|
||
<h2>Affected code paths</h2>
|
||
<ul>
|
||
<li><code>BytesStart::attributes()</code> / <code>Attributes</code> iterated with checks enabled (the
|
||
default), and <code>BytesStart::try_get_attribute</code>.</li>
|
||
<li><code>NsReader</code>, which resolves namespaces by iterating a tag's attributes and so
|
||
reaches the same check internally.</li>
|
||
</ul>
|
||
<p>Consumers that iterate attributes with <code>.attributes().with_checks(false)</code> and do
|
||
not use <code>NsReader</code> are not affected.</p>
|
||
<p>This was reported as reachable by a remote, unauthenticated attacker in a
|
||
real-world RPKI relying party (NLnet Labs Routinator) via a crafted RRDP
|
||
<code>snapshot.xml</code>.</p>
|
||
<h2>Remediation</h2>
|
||
<p>Upgrade to <code>quick-xml &gt;= 0.41.0</code>, where the duplicate check keeps the linear
|
||
scan for start tags with a small number of attributes and switches to an <code>O(1)</code>
|
||
hash pre-filter above a threshold, making the whole tag <code>O(N)</code>. The reported
|
||
<code>AttrError::Duplicated</code> positions are unchanged.</p>
|
||
<p>If upgrading is not possible and duplicate-name detection is not required,
|
||
disable it with <code>.attributes().with_checks(false)</code> (this does not help
|
||
<code>NsReader</code> consumers, which have no equivalent opt-out before 0.41.0).</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0195: Vulnerability in quick-xml</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0195.html</id><updated>2026-07-02T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0195.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0195: Vulnerability in quick-xml"/><published>2026-07-02T12:00:00+00:00</published><summary xml:lang="en">Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/quick-xml/RUSTSEC-2026-0195.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/quick-xml/RUSTSEC-2026-0195.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0195">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0195
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Unbounded namespace-declaration allocation in <code>NsReader</code> enables memory-exhaustion denial of service</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-02">
|
||
July 2, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/quick-xml.html">quick-xml</a>
|
||
|
||
(<a href="https://crates.io/crates/quick-xml">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/xml.html">#xml</a>
|
||
|
||
<a href="/keywords/parser.html">#parser</a>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/memory.html">#memory</a>
|
||
|
||
<a href="/keywords/namespace.html">#namespace</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/issues/970">
|
||
https://github.com/tafia/quick-xml/issues/970
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/commit/7ca25266e94987210daa864889ab15c9332c8a2a">
|
||
https://github.com/tafia/quick-xml/commit/7ca25266e94987210daa864889ab15c9332c8a2a
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.41.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>NsReader</code> resolves namespaces by calling <code>NamespaceResolver::push</code> for every
|
||
<code>Start</code>/<code>Empty</code> event <em>before</em> the event is returned to the caller. <code>push</code>
|
||
iterated all <code>xmlns</code> / <code>xmlns:*</code> attributes on the start tag and, for each one,
|
||
appended the prefix bytes to an internal buffer and pushed a <code>NamespaceBinding</code>
|
||
(32 bytes on 64-bit) to an internal <code>Vec</code>, with no upper bound on the number of
|
||
declarations.</p>
|
||
<h2>Impact</h2>
|
||
<p>A start tag with <code>N</code> namespace declarations drove roughly <code>3×</code> the tag's byte
|
||
size in <code>NamespaceResolver</code> heap, allocated <em>inside</em> <code>quick-xml</code> before the
|
||
<code>NsReader</code> consumer ever received the event and could inspect or reject it. A
|
||
consumer that bounds its <em>input</em> size therefore still cannot bound this
|
||
allocation: an <code>M</code>-byte start tag yields on the order of <code>3 × M</code> bytes of
|
||
resolver heap the caller never sees.</p>
|
||
<p>On untrusted XML this lets a remote, unauthenticated attacker force large heap
|
||
allocations with a single start tag. With several <code>NsReader</code>s running
|
||
concurrently on independent inputs (a common server pattern), the allocations
|
||
stack and can exhaust process memory, causing the operating system to kill the
|
||
process (OOM). This was confirmed against a real-world RPKI relying party (NLnet
|
||
Labs Routinator), where concurrent RRDP validation workers parsing a crafted
|
||
<code>snapshot.xml</code> exceeded the memory limit and the process was OOM-killed.</p>
|
||
<h2>Affected code paths</h2>
|
||
<p>Consumers using <code>NsReader</code> (which always calls <code>NamespaceResolver::push</code> before
|
||
yielding <code>Start</code>/<code>Empty</code>), or calling <code>NamespaceResolver::push</code> directly. A plain
|
||
<code>Reader</code> that does not perform namespace resolution is not affected.</p>
|
||
<h2>Remediation</h2>
|
||
<p>Upgrade to <code>quick-xml &gt;= 0.41.0</code>. <code>NamespaceResolver::push</code> now rejects a start
|
||
tag that declares more than <code>DEFAULT_MAX_DECLARATIONS_PER_ELEMENT</code> (256)
|
||
namespace bindings, returning the new <code>NamespaceError::TooManyDeclarations</code>
|
||
instead of allocating without limit. The limit is configurable via
|
||
<code>NamespaceResolver::set_max_declarations_per_element</code> (use <code>usize::MAX</code> to
|
||
restore the previous unbounded behavior), and <code>NsReader::resolver_mut()</code> is
|
||
provided to reach it.</p>
|
||
<p>There is no clean workaround for <code>NsReader</code> consumers before 0.41.0, as the
|
||
allocation happens inside the reader with no configuration knob to cap it.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0193: Vulnerability in ammonia</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0193.html</id><updated>2026-07-01T12:00:00+00:00</updated><category term="format-injection"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0193.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0193: Vulnerability in ammonia"/><published>2026-06-30T12:00:00+00:00</published><summary xml:lang="en">mXSS in ammonia via MathML `annotation-xml` encoding strip</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/ammonia/RUSTSEC-2026-0193.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/ammonia/RUSTSEC-2026-0193.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0193">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0193
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>mXSS in ammonia via MathML <code>annotation-xml</code> encoding strip</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-30">
|
||
June 30, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-30">
|
||
June 30, 2026
|
||
</time>
|
||
|
||
<time datetime="2026-07-01">
|
||
(last modified: July 1, 2026)
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/ammonia.html">ammonia</a>
|
||
|
||
(<a href="https://crates.io/crates/ammonia">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/format-injection.html">format-injection</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/html.html">#html</a>
|
||
|
||
<a href="/keywords/xss.html">#xss</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-9jh8-v38h-cvhr">GHSA-9jh8-v38h-cvhr</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=4.1.3</code></li>
|
||
|
||
<li><code>&#62;=4.0.2, &#60;4.1.0</code></li>
|
||
|
||
<li><code>&#62;=3.3.2, &#60;4.0.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.</p>
|
||
<p>The <code>annotation-xml</code> tag has slightly different behavior than the other &quot;integration point&quot;
|
||
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
|
||
strip the namespace-incompatible tags.</p>
|
||
<p>This vulnerability only has an effect when the <code>math</code> and <code>annotation-xml</code> tags
|
||
are both enabled, but the <code>encoding</code> attribute is disabled, because it relies
|
||
on the following sequence of steps:</p>
|
||
<ol>
|
||
<li>User writes code like <code>&lt;math&gt;&lt;annotation-xml encoding=&quot;text/html&quot;&gt;&lt;gadget&gt;&lt;/annotation-xml&gt;&lt;/math&gt;</code>.</li>
|
||
<li>Namespace filtering checks the DOM, and it passes. <code>&lt;gadget&gt;</code> is parsed as HTML.</li>
|
||
<li>Attribute filter strips it down to <code>&lt;math&gt;&lt;annotation-xml&gt;&lt;gadget&gt;&lt;/annotation-xml&gt;&lt;/math&gt;</code>. Because the encoding attribute is gone, <code>&lt;gadget&gt;</code> is now parsed as MathML.</li>
|
||
<li>The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.</li>
|
||
</ol>
|
||
<p>Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
|
||
These <a href="https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs">elements</a> are:</p>
|
||
<ul>
|
||
<li>title</li>
|
||
<li>textarea</li>
|
||
<li>xmp</li>
|
||
<li>iframe</li>
|
||
<li>noembed</li>
|
||
<li>noframes</li>
|
||
<li>plaintext</li>
|
||
<li>noscript</li>
|
||
<li>style</li>
|
||
<li>script</li>
|
||
</ul>
|
||
<p>Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.</p>
|
||
<hr />
|
||
<p><strong>Discovered by:</strong> ivan0912 (YesWeHack) · <strong>Date:</strong> 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0192: ttf-parser is unmaintained</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0192.html</id><updated>2026-06-29T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0192.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0192: ttf-parser is unmaintained"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">`ttf-parser` is unmaintained</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/ttf-parser/RUSTSEC-2026-0192.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/ttf-parser/RUSTSEC-2026-0192.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0192">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0192
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>ttf-parser</code> is unmaintained</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-28">
|
||
June 28, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/ttf-parser.html">ttf-parser</a>
|
||
|
||
(<a href="https://crates.io/crates/ttf-parser">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unmaintained
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/harfbuzz/ttf-parser/issues/217">
|
||
https://github.com/harfbuzz/ttf-parser/issues/217
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The author of <code>ttf-parser</code> has stated that the crate is unmaintained and will not receive further fixes (see the referenced issue).</p>
|
||
<h2>Alternative(s)</h2>
|
||
<ul>
|
||
<li><a href="https://crates.io/crates/skrifa"><code>skrifa</code></a>, an actively maintained TrueType and OpenType font parsing crate, part of the Google Fonts &quot;oxidize&quot; (<code>fontations</code>) project.</li>
|
||
</ul>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0188: Vulnerability in wasmtime-wasi</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0188.html</id><updated>2026-06-29T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0188.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0188: Vulnerability in wasmtime-wasi"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">WASI hard links and renames bypass wasmtime-wasi&apos;s FilePerms for destination</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime-wasi/RUSTSEC-2026-0188.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime-wasi/RUSTSEC-2026-0188.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0188">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0188
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-24">
|
||
June 24, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/wasmtime-wasi.html">wasmtime-wasi</a>
|
||
|
||
(<a href="https://crates.io/crates/wasmtime-wasi">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-4ch3-9j33-3pmj">GHSA-4ch3-9j33-3pmj</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj">
|
||
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>6.5 <span class="tag medium">
|
||
MEDIUM
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Local</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Changed</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=46.0.1</code></li>
|
||
|
||
<li><code>&#62;=45.0.3, &#60;46.0.0</code></li>
|
||
|
||
<li><code>&#62;=36.0.12, &#60;37.0.0</code></li>
|
||
|
||
<li><code>&#62;=24.0.11, &#60;25.0.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>This is an entry in the RustSec database for the Wasmtime security advisory
|
||
located at
|
||
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj
|
||
For more information see the GitHub-hosted security advisory.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0189: Vulnerability in rmcp</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0189.html</id><updated>2026-06-30T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0189.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0189: Vulnerability in rmcp"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">DNS rebinding vulnerability in rmcp Streamable HTTP server transport</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/rmcp/RUSTSEC-2026-0189.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/rmcp/RUSTSEC-2026-0189.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0189">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0189
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>DNS rebinding vulnerability in rmcp Streamable HTTP server transport</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-04-29">
|
||
April 29, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
<time datetime="2026-06-30">
|
||
(last modified: June 30, 2026)
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/rmcp.html">rmcp</a>
|
||
|
||
(<a href="https://crates.io/crates/rmcp">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/dns-rebinding.html">#dns-rebinding</a>
|
||
|
||
<a href="/keywords/mcp.html">#mcp</a>
|
||
|
||
<a href="/keywords/http.html">#http</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42559">CVE-2026-42559</a>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-89vp-x53w-74fx">GHSA-89vp-x53w-74fx</a>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-fvh2-gm75-j4j7">GHSA-fvh2-gm75-j4j7</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx">
|
||
https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/pull/764">
|
||
https://github.com/modelcontextprotocol/rust-sdk/pull/764
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/issues/815">
|
||
https://github.com/modelcontextprotocol/rust-sdk/issues/815
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/issues/822">
|
||
https://github.com/modelcontextprotocol/rust-sdk/issues/822
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning">
|
||
https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="related">Related</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-fvh2-gm75-j4j7">GHSA-fvh2-gm75-j4j7</a>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<a href="https://rustsec.org/advisories/RUSTSEC-2026-0140">RUSTSEC-2026-0140</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>8.8 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>Required</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=1.4.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Prior to version 1.4.0, the <code>rmcp</code> crate's Streamable HTTP server transport did
|
||
not validate the incoming <code>Host</code> header.</p>
|
||
<p>This allowed a malicious public website, via a DNS rebinding attack, to send
|
||
requests to an MCP server running on the victim's loopback or private-network
|
||
interface.</p>
|
||
<p>An attacker who convinced a victim to visit a malicious page could enumerate and
|
||
invoke tools exposed by a locally running rmcp-based MCP server, read resources
|
||
and prompts, and trigger side effects limited by the tools exposed by that
|
||
server.</p>
|
||
<p>Non-HTTP transports such as stdio and child-process transports are not affected.</p>
|
||
<h2>Patches</h2>
|
||
<p>The issue was fixed in <code>rmcp</code> 1.4.0 by adding default loopback-only host
|
||
allowlist validation for the Streamable HTTP server transport. Incoming HTTP
|
||
requests now validate the <code>Host</code> header and return HTTP 403 when the host is not
|
||
allowed.</p>
|
||
<p>Users should upgrade to <code>rmcp &gt;= 1.4.0</code>.</p>
|
||
<h2>Workarounds</h2>
|
||
<p>If upgrading is not possible, place the MCP server behind a reverse proxy
|
||
configured to reject requests whose <code>Host</code> header is not one of the expected
|
||
hostnames. Do not bind the MCP server to <code>0.0.0.0</code> without such validation.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0190: Unsoundness in anyhow</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0190.html</id><updated>2026-06-29T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0190.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0190: Unsoundness in anyhow"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">Unsoundness in `Error::downcast_mut()`</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/anyhow/RUSTSEC-2026-0190.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/anyhow/RUSTSEC-2026-0190.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0190">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0190
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Unsoundness in <code>Error::downcast_mut()</code></p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-25">
|
||
June 25, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/anyhow.html">anyhow</a>
|
||
|
||
(<a href="https://crates.io/crates/anyhow">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/unsound.html">#unsound</a>
|
||
|
||
<a href="/keywords/downcast_mut.html">#downcast_mut</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/dtolnay/anyhow/issues/451">
|
||
https://github.com/dtolnay/anyhow/issues/451
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=1.0.103</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>anyhow::Error::downcast_mut</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;1.0.103</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via <code>Error::context</code> and then later calls <code>Error::downcast_mut</code> on the returned <code>Error</code>.</p>
|
||
<p>The flaw was corrected in commit <code>6e8c000</code> by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain.</p>
|
||
<h2>Example</h2>
|
||
<pre><code class="language-rust">use anyhow::Error;
|
||
use std::fmt;
|
||
|
||
#[derive(Debug)]
|
||
struct ErrorContext(&amp;'static str);
|
||
|
||
impl fmt::Display for ErrorContext {
|
||
fn fmt(&amp;self, f: &amp;mut fmt::Formatter&lt;'_&gt;) -&gt; fmt::Result {
|
||
fmt::Display::fmt(&amp;self.0, f)
|
||
}
|
||
}
|
||
|
||
fn main() {
|
||
let mut error = Error::msg(&quot;inner error&quot;).context(ErrorContext(&quot;old context&quot;));
|
||
let context: &amp;mut ErrorContext = error.downcast_mut().unwrap();
|
||
context.0 = &quot;new context&quot;;
|
||
println!(&quot;{:?}&quot;, error);
|
||
}
|
||
</code></pre>
|
||
<h2>Miri output</h2>
|
||
<pre><code>error: Undefined Behavior: trying to retag from &lt;1538&gt; for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location
|
||
--&gt; src/ptr.rs:170:18
|
||
|
|
||
170 | unsafe { &amp;mut *self.ptr.as_ptr() }
|
||
| ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48]
|
||
|
|
||
= help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
|
||
= help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
|
||
help: &lt;1538&gt; was created by a SharedReadOnly retag at offsets [0x38..0x48]
|
||
--&gt; src/ptr.rs:89:18
|
||
|
|
||
89 | ptr: NonNull::from(ptr),
|
||
| ^^^^^^^^^^^^^^^^^^
|
||
= note: stack backtrace:
|
||
0: anyhow::ptr::Mut::&lt;'_, ErrorContext&gt;::deref_mut
|
||
at src/ptr.rs:170:18: 170:41
|
||
1: anyhow::error::&lt;impl anyhow::Error&gt;::downcast_mut::&lt;ErrorContext&gt;
|
||
at src/error.rs:560:18: 560:46
|
||
2: main
|
||
at examples/downcast_mut.rs:15:38: 15:58
|
||
</code></pre>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2025-0165: Unsoundness in i_tree</title><id>https://rustsec.org/advisories/RUSTSEC-2025-0165.html</id><updated>2026-06-29T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2025-0165.html" rel="alternate" type="text/html" title="RUSTSEC-2025-0165: Unsoundness in i_tree"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">i_tree allowed out-of-bounds access through safe public node accessors</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/i_tree/RUSTSEC-2025-0165.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/i_tree/RUSTSEC-2025-0165.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2025-0165">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2025-0165
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>i_tree allowed out-of-bounds access through safe public node accessors</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2025-07-04">
|
||
July 4, 2025
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/i_tree.html">i_tree</a>
|
||
|
||
(<a href="https://crates.io/crates/i_tree">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/iShape-Rust/iTree/issues/1">
|
||
https://github.com/iShape-Rust/iTree/issues/1
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/iShape-Rust/iTree/commit/a948b891cf159233bfed5b16bf185268fd9e1985">
|
||
https://github.com/iShape-Rust/iTree/commit/a948b891cf159233bfed5b16bf185268fd9e1985
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/iShape-Rust/iTree/compare/0.9.0...0.10.0">
|
||
https://github.com/iShape-Rust/iTree/compare/0.9.0...0.10.0
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.10.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>i_tree::tree::Tree::mut_node</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.10.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><code>i_tree::tree::Tree::node</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.10.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of <code>i_tree</code> exposed safe public <code>Tree::node</code> and <code>Tree::mut_node</code> methods in the public <code>tree</code> module. These methods accepted an arbitrary <code>u32</code> index and passed it directly to <code>Vec::get_unchecked</code> / <code>get_unchecked_mut</code> on the internal node buffer, without validating that the index was in bounds.</p>
|
||
<p>Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any <code>unsafe</code> code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.</p>
|
||
<p>Starting with <code>0.10.0</code> the crate was restructured and these accessors are no longer reachable from outside the crate.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0191: Unsoundness in solana_rbpf</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0191.html</id><updated>2026-06-29T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0191.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0191: Unsoundness in solana_rbpf"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/solana_rbpf/RUSTSEC-2026-0191.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/solana_rbpf/RUSTSEC-2026-0191.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0191">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0191
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>EbpfVm::invoke_function</code> performs out-of-bounds pointer arithmetic</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-05-28">
|
||
May 28, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/solana_rbpf.html">solana_rbpf</a>
|
||
|
||
(<a href="https://crates.io/crates/solana_rbpf">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/soundness.html">#soundness</a>
|
||
|
||
<a href="/keywords/pointer-arithmetic.html">#pointer-arithmetic</a>
|
||
|
||
<a href="/keywords/out-of-bounds.html">#out-of-bounds</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/solana-labs/rbpf">
|
||
https://github.com/solana-labs/rbpf
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/anza-xyz/sbpf/pull/151">
|
||
https://github.com/anza-xyz/sbpf/pull/151
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://crates.io/crates/solana-sbpf">
|
||
https://crates.io/crates/solana-sbpf
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="unaffected">Unaffected</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.8.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>solana_rbpf::vm::EbpfVm::invoke_function</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.8.0, &#60;=0.8.5</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of <code>solana_rbpf</code> expose the safe method
|
||
<code>EbpfVm::invoke_function</code>. This method computes an obfuscated VM pointer by
|
||
casting <code>self</code> to <code>*mut u64</code> and applying a randomized offset derived from
|
||
<code>get_runtime_environment_key()</code>.</p>
|
||
<p>The resulting pointer arithmetic is performed with <code>ptr::offset</code>, which
|
||
requires the computed pointer to remain within the same allocation. In practice,
|
||
the randomized offset can move the pointer far outside the allocation
|
||
containing the <code>EbpfVm</code>, causing undefined behavior before the supplied builtin
|
||
function is invoked.</p>
|
||
<h2>Unmaintained</h2>
|
||
<p>The upstream <code>solana_rbpf</code> repository is archived, and no patched version of
|
||
this crate is currently available.</p>
|
||
<p>Users should migrate to the maintained <a href="https://crates.io/crates/solana-sbpf"><code>solana-sbpf</code></a>
|
||
crate. The issue has been fixed there in
|
||
<a href="https://github.com/anza-xyz/sbpf/pull/151"><code>anza-xyz/sbpf#151</code></a>.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0187: Vulnerability in lopdf</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0187.html</id><updated>2026-06-26T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0187.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0187: Vulnerability in lopdf"/><published>2026-06-26T12:00:00+00:00</published><summary xml:lang="en">Stack overflow in lopdf via deeply nested PDF objects</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/lopdf/RUSTSEC-2026-0187.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/lopdf/RUSTSEC-2026-0187.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0187">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0187
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Stack overflow in lopdf via deeply nested PDF objects</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-21">
|
||
June 21, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-26">
|
||
June 26, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/lopdf.html">lopdf</a>
|
||
|
||
(<a href="https://crates.io/crates/lopdf">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/stack-overflow.html">#stack-overflow</a>
|
||
|
||
<a href="/keywords/recursion.html">#recursion</a>
|
||
|
||
<a href="/keywords/untrusted-input.html">#untrusted-input</a>
|
||
|
||
<a href="/keywords/pdf.html">#pdf</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/J-F-Liu/lopdf/issues/502">
|
||
https://github.com/J-F-Liu/lopdf/issues/502
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/J-F-Liu/lopdf/pull/503">
|
||
https://github.com/J-F-Liu/lopdf/pull/503
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/J-F-Liu/lopdf/commit/c755394">
|
||
https://github.com/J-F-Liu/lopdf/commit/c755394
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.42.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>lopdf::Document::load_mem</code> (and the other <code>load*</code> entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (<code>/X [[[ … ]]]</code>, on the order of 10,000 levels) exhausts the call stack and aborts the process with <code>SIGABRT</code>.</p>
|
||
<p>Because this is a stack-overflow abort rather than a <code>panic!</code>, it cannot be caught with <code>catch_unwind</code>: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting in a denial of service.</p>
|
||
<p>Confirmed on lopdf 0.41.0 and earlier; fixed in 0.42.0. Default configuration, no features changed.</p>
|
||
<h2>Proof of concept</h2>
|
||
<pre><code class="language-rust">fn main() {
|
||
let bytes = std::fs::read(&quot;poc.pdf&quot;).unwrap(); // ~10,380-deep nested array in the Catalog
|
||
let _ = lopdf::Document::load_mem(&amp;bytes); // stack overflow -&gt; SIGABRT
|
||
}
|
||
</code></pre>
|
||
<p>An equivalent PoC is a minimal PDF whose Catalog <code>/X</code> value is <code>&quot;[&quot; * 10380 + &quot;]&quot; * 10380</code>.</p>
|
||
<h2>Suggested fix</h2>
|
||
<p>Enforce a maximum object-nesting depth in the parser and return an <code>Err</code> instead of recursing without bound.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry></feed> |