mirror of
https://github.com/rustsec/advisory-db.git
synced 2026-07-22 01:06:54 -04:00
3224 lines
113 KiB
XML
3224 lines
113 KiB
XML
<?xml version="1.0"?>
|
||
<feed xmlns="http://www.w3.org/2005/Atom"><title>RustSec Advisories</title><id>https://rustsec.org/feed.xml</id><updated>2026-07-06T12:00:00+00:00</updated><author><name>RustSec</name></author><icon>https://rustsec.org/favicon.ico</icon><link href="https://rustsec.org/feed.xml" rel="self" type="application/atom+xml"/><link href="https://rustsec.org/" rel="alternate" type="text/html"/><subtitle xml:lang="en">Security advisories filed against Rust crates</subtitle><entry><title>RUSTSEC-2026-0203: tree-sitter-perl-next is unmaintained</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0203.html</id><updated>2026-07-06T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0203.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0203: tree-sitter-perl-next is unmaintained"/><published>2026-07-06T12:00:00+00:00</published><summary xml:lang="en">`tree-sitter-perl-next` is unmaintained</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/tree-sitter-perl-next/RUSTSEC-2026-0203.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/tree-sitter-perl-next/RUSTSEC-2026-0203.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0203">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0203
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>tree-sitter-perl-next</code> is unmaintained</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-06">
|
||
July 6, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-06">
|
||
July 6, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/tree-sitter-perl-next.html">tree-sitter-perl-next</a>
|
||
|
||
(<a href="https://crates.io/crates/tree-sitter-perl-next">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unmaintained
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/PRRPCHT/tree-sitter-perl-next">
|
||
https://github.com/PRRPCHT/tree-sitter-perl-next
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The author of <code>tree-sitter-perl-next</code> has stated that the crate is unmaintained and will not receive further fixes (see the repo's readme).</p>
|
||
<h2>Alternative(s)</h2>
|
||
<ul>
|
||
<li><a href="https://crates.io/crates/ts-parser-perl"><code>ts-parser-perl </code></a>, an actively maintained tree-sitter Perl grammar that tree-sitter-perl-next initially forked.</li>
|
||
</ul>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0202: Unsoundness in cxx</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0202.html</id><updated>2026-07-05T12:00:00+00:00</updated><category term="memory-exposure"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0202.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0202: Unsoundness in cxx"/><published>2026-07-05T12:00:00+00:00</published><summary xml:lang="en">`let_cxx_string!` uses uninitialized value due to exception safety violations</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/cxx/RUSTSEC-2026-0202.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/cxx/RUSTSEC-2026-0202.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0202">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0202
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>let_cxx_string!</code> uses uninitialized value due to exception safety violations</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-05">
|
||
July 5, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-05">
|
||
July 5, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/cxx.html">cxx</a>
|
||
|
||
(<a href="https://crates.io/crates/cxx">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-exposure.html">memory-exposure</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/exception.html">#exception</a>
|
||
|
||
<a href="/keywords/unwind.html">#unwind</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/dtolnay/cxx/issues/1729">
|
||
https://github.com/dtolnay/cxx/issues/1729
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=1.0.195</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>cxx::let_cxx_string</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;1.0.195</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>In affected versions of this crate, <code>let_cxx_string!</code> is not exception safe. After creating the <code>StackString</code>, if <code>match $value</code> panics, the content of <code>StackString</code> is not yet initialized, while the drop implementation of <code>StackString</code> unconditionally deinitializes the content, leading to use of uninitialized value.</p>
|
||
<p>The soundness issue was fixed in version <code>1.0.195</code> by moving drop logics to separate drop guard after initializing the <code>StackString</code>.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0199: Vulnerability in bcrypt</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0199.html</id><updated>2026-07-04T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0199.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0199: Vulnerability in bcrypt"/><published>2026-07-04T12:00:00+00:00</published><summary xml:lang="en">Panic in `bcrypt::verify` on non-ASCII hash input</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/bcrypt/RUSTSEC-2026-0199.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/bcrypt/RUSTSEC-2026-0199.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0199">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0199
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Panic in <code>bcrypt::verify</code> on non-ASCII hash input</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-20">
|
||
June 20, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-04">
|
||
July 4, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/bcrypt.html">bcrypt</a>
|
||
|
||
(<a href="https://crates.io/crates/bcrypt">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/panic.html">#panic</a>
|
||
|
||
<a href="/keywords/utf-8.html">#utf-8</a>
|
||
|
||
<a href="/keywords/denial-of-service.html">#denial-of-service</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/Keats/rust-bcrypt/pull/103">
|
||
https://github.com/Keats/rust-bcrypt/pull/103
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/Keats/rust-bcrypt/issues/62">
|
||
https://github.com/Keats/rust-bcrypt/issues/62
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/Keats/rust-bcrypt/pull/95">
|
||
https://github.com/Keats/rust-bcrypt/pull/95
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/Keats/rust-bcrypt/commit/f5f1ee2862c1198a85afe3c2f8cd80835162b7e9">
|
||
https://github.com/Keats/rust-bcrypt/commit/f5f1ee2862c1198a85afe3c2f8cd80835162b7e9
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>5.3 <span class="tag medium">
|
||
MEDIUM
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>Low</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.19.2</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="unaffected">Unaffected</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.19.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>bcrypt::verify(password, hash)</code> and <code>HashParts::from_str(hash)</code> panic in
|
||
<code>str::slice_error_fail</code> when given a 60-byte <code>&amp;str</code> containing a multi-byte
|
||
UTF-8 character at certain byte positions.</p>
|
||
<h2>Impact</h2>
|
||
<p>Any Rust code that calls <code>bcrypt::verify</code> (or <code>HashParts::from_str</code>) with an
|
||
attacker-controlled hash string will panic. The <code>bcrypt</code> crate is
|
||
<code>#![forbid(unsafe_code)]</code>, so this is limited to a denial-of-service and
|
||
cannot lead to memory corruption.</p>
|
||
<p>Realistic attack contexts include:</p>
|
||
<ul>
|
||
<li>Rust authentication services reading hashes from a database that was
|
||
previously compromised via, e.g., SQL injection. The attacker can then
|
||
crash the service on every login attempt against the tampered account.</li>
|
||
<li>CLI tools accepting hashes from stdin or command-line arguments.</li>
|
||
<li>Password managers or vault services loading hashes from untrusted
|
||
configuration sources.</li>
|
||
</ul>
|
||
<h2>Root cause</h2>
|
||
<p><code>split_hash</code> performed five <code>&amp;str</code> slicing operations on the input hash:
|
||
<code>&amp;hash[1..3]</code>, <code>&amp;hash[4..6]</code>, <code>&amp;hash[7..]</code>, <code>&amp;salt_and_hash[..22]</code>, and
|
||
<code>&amp;salt_and_hash[22..]</code>. None of these were char-boundary-checked. Any input
|
||
where a multi-byte UTF-8 character spanned one of those byte positions
|
||
caused a panic.</p>
|
||
<p>This is a regression of the fix originally shipped in 2021 for issue #62
|
||
(commit <code>0833509</code>). The regression was introduced in the parser rewrite in
|
||
PR #95 (commit <code>e9a8394</code>, released as 0.19.0).</p>
|
||
<p>The pre-existing regression test <code>does_no_error_on_char_boundary_splitting</code>
|
||
was not removed, but was silently rendered ineffective by the new
|
||
<code>bytes[0] != b'$'</code> guard, which rejected its input earlier and prevented
|
||
it from reaching the buggy slices — leaving CI green through the regression.</p>
|
||
<h2>Fix</h2>
|
||
<p><code>split_hash</code> now rejects any hash string containing non-ASCII bytes up
|
||
front. A valid bcrypt hash is always exactly 60 ASCII bytes, so this
|
||
closes the entire class of byte-boundary panics rather than guarding each
|
||
slice individually.</p>
|
||
<p>The fix was merged in PR #103 and released as <code>bcrypt 0.19.2</code> on 2026-06-20.</p>
|
||
<h2>Downstream impact</h2>
|
||
<p><code>pyca/bcrypt</code> (which depended on <code>bcrypt 0.19.1</code>) is <strong>not</strong> affected. Its
|
||
Python-side wrapper performs its own byte-level salt parsing before
|
||
invoking <code>bcrypt::hash_with_salt</code>, and never reaches the buggy code path
|
||
in <code>split_hash</code> or <code>verify</code>.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0201: Vulnerability in fulgur</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0201.html</id><updated>2026-07-04T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0201.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0201: Vulnerability in fulgur"/><published>2026-07-04T12:00:00+00:00</published><summary xml:lang="en">Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/fulgur/RUSTSEC-2026-0201.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/fulgur/RUSTSEC-2026-0201.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0201">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0201
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-05">
|
||
July 5, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-04">
|
||
July 4, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/fulgur.html">fulgur</a>
|
||
|
||
(<a href="https://crates.io/crates/fulgur">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/pagination.html">#pagination</a>
|
||
|
||
<a href="/keywords/pdf.html">#pdf</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-4rf6-qx84-q9fv">GHSA-4rf6-qx84-q9fv</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv">
|
||
https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.26.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>fulgur</code> converts untrusted HTML/CSS into PDF, commonly on a server that
|
||
processes input supplied by many tenants. In versions prior to 0.26.0, a
|
||
childless box that resolves to a pathologically tall height was amplified into
|
||
thousands of blank PDF pages, even when it produces no visible output.</p>
|
||
<p>The childless-collapse defense that would normally collapse such a box was gated
|
||
by a tag-only &quot;replaced content&quot; check, so any non-painting replaced element
|
||
bypassed it, including an unresolved <code>src</code> (the common offline-first case), a
|
||
<code>visibility:hidden</code> image, an undecodable image format, and an empty <code>&lt;svg&gt;</code>. A
|
||
trailing-sibling variant of the same gap was also open.</p>
|
||
<p>A few bytes of HTML therefore amplified into roughly <code>MAX_PAGES</code> (10,000) blank
|
||
pages; the renderer allocates and runs a per-page loop over them, producing CPU
|
||
and memory exhaustion. An attacker able to submit HTML to a fulgur-based
|
||
conversion service can trigger this with a trivially small payload, denying
|
||
service to the host and any co-tenants.</p>
|
||
<p>Fixed in 0.26.0: the tag-only gate was removed so that any pathologically tall
|
||
childless box collapses regardless of whether it is a replaced element, closing
|
||
the missing-<code>src</code>, <code>visibility:hidden</code>, undecodable-format, and empty-<code>&lt;svg&gt;</code>
|
||
vectors along with the trailing-sibling variant.</p>
|
||
<p>Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an
|
||
unbounded (rather than 10,000-page) variant of this amplification; that earlier
|
||
variant is tracked separately as GHSA-j5cx-ph8g-95v3.</p>
|
||
<h2>Attack Vector rationale</h2>
|
||
<p><code>fulgur</code> performs no network I/O of its own; it renders HTML/CSS handed to it by
|
||
the embedding application. This advisory scores the crate independent of any
|
||
specific adopting program, so per the CVSS v3.1 User Guide §3.7 the Attack
|
||
Vector is assessed as Network for the reasonable worst-case deployment — a
|
||
network-facing service that renders untrusted HTML without user interaction. A
|
||
concrete system that receives the HTML in one component and passes it to fulgur
|
||
in a separate component may assess a lower environmental Attack Vector (Local,
|
||
per §3.10).</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0200: Vulnerability in fulgur</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0200.html</id><updated>2026-07-04T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0200.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0200: Vulnerability in fulgur"/><published>2026-07-04T12:00:00+00:00</published><summary xml:lang="en">Unbounded page slicing from attacker-controlled CSS height causes denial of service</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/fulgur/RUSTSEC-2026-0200.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/fulgur/RUSTSEC-2026-0200.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0200">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0200
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Unbounded page slicing from attacker-controlled CSS height causes denial of service</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-05">
|
||
July 5, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-04">
|
||
July 4, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/fulgur.html">fulgur</a>
|
||
|
||
(<a href="https://crates.io/crates/fulgur">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/pagination.html">#pagination</a>
|
||
|
||
<a href="/keywords/pdf.html">#pdf</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-j5cx-ph8g-95v3">GHSA-j5cx-ph8g-95v3</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3">
|
||
https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.19.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>fulgur</code> converts untrusted HTML/CSS into PDF, commonly on a server that
|
||
processes input supplied by many tenants. In versions prior to 0.19.0, a
|
||
body-direct child whose CSS-resolved height greatly exceeds the page height was
|
||
sliced into one fragment per page with no upper bound.</p>
|
||
<p>The height is taken directly from attacker-controlled HTML/CSS (<code>height</code>, <code>vh</code>
|
||
units), so a few bytes such as <code>&lt;div style=&quot;height:99999999px&quot;&gt;&lt;/div&gt;</code> forced on
|
||
the order of 125,000 page fragments. The pagination code then allocates
|
||
<code>vec![Vec::new(); page_count]</code> and runs a per-page render loop, resulting in CPU
|
||
and memory exhaustion. A non-finite height (one that resolves to <code>+inf</code>)
|
||
additionally made the slicing loop's <code>remaining -= last_slice_h</code> decrement never
|
||
terminate, causing an infinite loop.</p>
|
||
<p>An attacker able to submit HTML/CSS to a fulgur-based conversion service can
|
||
trigger this with a trivially small payload, denying service to the host and any
|
||
co-tenants.</p>
|
||
<p>Fixed in 0.19.0: a <code>MAX_PAGES</code> cap bounds the slice loop — halting it even for a
|
||
<code>+inf</code> height — and non-finite layout heights are sanitized so they can no
|
||
longer drive the loop.</p>
|
||
<h2>Attack Vector rationale</h2>
|
||
<p><code>fulgur</code> performs no network I/O of its own; it renders HTML/CSS handed to it by
|
||
the embedding application. This advisory scores the crate independent of any
|
||
specific adopting program, so per the CVSS v3.1 User Guide §3.7 the Attack
|
||
Vector is assessed as Network for the reasonable worst-case deployment — a
|
||
network-facing service that renders untrusted HTML without user interaction. A
|
||
concrete system that receives the HTML in one component and passes it to fulgur
|
||
in a separate component may assess a lower environmental Attack Vector (Local,
|
||
per §3.10).</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0198: Unsoundness in error-stack</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0198.html</id><updated>2026-07-03T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0198.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0198: Unsoundness in error-stack"/><published>2026-07-03T12:00:00+00:00</published><summary xml:lang="en">`Report::frames_mut` allows aliased mutable references</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/error-stack/RUSTSEC-2026-0198.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/error-stack/RUSTSEC-2026-0198.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0198">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0198
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>Report::frames_mut</code> allows aliased mutable references</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-03">
|
||
July 3, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-03">
|
||
July 3, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/error-stack.html">error-stack</a>
|
||
|
||
(<a href="https://crates.io/crates/error-stack">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/aliasing.html">#aliasing</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/hashintel/hash/issues/8945">
|
||
https://github.com/hashintel/hash/issues/8945
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/hashintel/hash/pull/8946">
|
||
https://github.com/hashintel/hash/pull/8946
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.8.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>error_stack::Report::frames_mut</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>*</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of this crate return an iterator from
|
||
<code>Report::frames_mut</code> whose <code>&amp;mut Frame</code> items have lifetimes independent
|
||
of the iterator, so all yielded references can be held at the same time.
|
||
A yielded frame's sources are also yielded by the iterator and reachable
|
||
through the parent frame via <code>Frame::sources_mut</code>, allowing safe code to
|
||
obtain two live mutable references to the same frame. This is undefined
|
||
behavior and can be used to cause a segmentation fault (see reproducer in
|
||
the linked issue). Versions 0.1.0 and 0.1.1 are affected through
|
||
<code>Frame::source_mut</code> instead of <code>Frame::sources_mut</code>.</p>
|
||
<p>The flaw is fixed in 0.8.0 by replacing the iterator with internal
|
||
iteration: <code>Report::frames_mut</code> now takes a visitor closure, so mutable
|
||
access to a frame is scoped and cannot overlap with access to its
|
||
sources.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0196: cgmath is unmaintained</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0196.html</id><updated>2026-07-03T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0196.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0196: cgmath is unmaintained"/><published>2026-07-03T12:00:00+00:00</published><summary xml:lang="en">`cgmath` is unmaintained</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/cgmath/RUSTSEC-2026-0196.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/cgmath/RUSTSEC-2026-0196.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0196">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0196
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>cgmath</code> is unmaintained</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-07-01">
|
||
July 1, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-03">
|
||
July 3, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/cgmath.html">cgmath</a>
|
||
|
||
(<a href="https://crates.io/crates/cgmath">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unmaintained
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/rustsec/advisory-db/pull/2910#pullrequestreview-4611570365">
|
||
https://github.com/rustsec/advisory-db/pull/2910#pullrequestreview-4611570365
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/rustgd/cgmath/issues/565">
|
||
https://github.com/rustgd/cgmath/issues/565
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The <code>cgmath</code> crate is no longer maintained.</p>
|
||
<p>Users should consider switching to a maintained alternative.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0197: Unsoundness in cgmath</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0197.html</id><updated>2026-07-03T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0197.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0197: Unsoundness in cgmath"/><published>2026-07-03T12:00:00+00:00</published><summary xml:lang="en">`Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/cgmath/RUSTSEC-2026-0197.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/cgmath/RUSTSEC-2026-0197.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0197">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0197
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>Matrix{2,3,4}::swap_columns</code> can trigger undefined behavior for identical indices</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-03-11">
|
||
March 11, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-03">
|
||
July 3, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/cgmath.html">cgmath</a>
|
||
|
||
(<a href="https://crates.io/crates/cgmath">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/soundness.html">#soundness</a>
|
||
|
||
<a href="/keywords/undefined-behavior.html">#undefined-behavior</a>
|
||
|
||
<a href="/keywords/aliasing.html">#aliasing</a>
|
||
|
||
<a href="/keywords/stacked-borrows.html">#stacked-borrows</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/rustgd/cgmath/issues/565">
|
||
https://github.com/rustgd/cgmath/issues/565
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>cgmath::Matrix2::swap_columns</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>=0.18.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><code>cgmath::Matrix3::swap_columns</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>=0.18.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><code>cgmath::Matrix4::swap_columns</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>=0.18.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The <code>Matrix2::swap_columns</code>, <code>Matrix3::swap_columns</code>, and <code>Matrix4::swap_columns</code>
|
||
implementations call <code>ptr::swap(&amp;mut self[a], &amp;mut self[b])</code>.</p>
|
||
<p>When <code>a == b</code>, these safe APIs create two mutable references to the same matrix
|
||
column and pass them to <code>ptr::swap</code>. This violates Rust's aliasing rules and can
|
||
trigger undefined behavior. The issue can be reproduced from safe Rust by calling
|
||
<code>swap_columns</code> with identical column indices, for example <code>m.swap_columns(0, 0)</code>.</p>
|
||
<p>A minimal fix is to return early when the two column indices are equal before
|
||
calling <code>ptr::swap</code>.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2025-0166: Unsoundness in stackvector</title><id>https://rustsec.org/advisories/RUSTSEC-2025-0166.html</id><updated>2026-07-02T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2025-0166.html" rel="alternate" type="text/html" title="RUSTSEC-2025-0166: Unsoundness in stackvector"/><published>2026-07-02T12:00:00+00:00</published><summary xml:lang="en">Multiple soundness issues in `stackvector`</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/stackvector/RUSTSEC-2025-0166.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/stackvector/RUSTSEC-2025-0166.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2025-0166">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2025-0166
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Multiple soundness issues in <code>stackvector</code></p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2025-10-23">
|
||
October 23, 2025
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-02">
|
||
July 2, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/stackvector.html">stackvector</a>
|
||
|
||
(<a href="https://crates.io/crates/stackvector">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/issues/3">
|
||
https://github.com/Alexhuszagh/rust-stackvector/issues/3
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/pull/6">
|
||
https://github.com/Alexhuszagh/rust-stackvector/pull/6
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357">
|
||
https://github.com/Alexhuszagh/rust-stackvector/commit/02b947afdeeb1be95ec0888354aa76afdd9d0357
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/Alexhuszagh/rust-stackvector/issues/5">
|
||
https://github.com/Alexhuszagh/rust-stackvector/issues/5
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=2.0.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of <code>stackvector</code> contained multiple soundness issues that could allow safe Rust code to trigger undefined behavior.</p>
|
||
<p>One issue was that <code>StackVec::length</code> was exposed as a public field. Safe Rust code could set <code>length</code> to a value larger than the backing array capacity. Other safe methods, including <code>remove</code>, <code>pop</code>, and <code>truncate</code>, relied on <code>length</code> before performing unsafe pointer operations (<code>ptr::read</code>, <code>ptr::copy</code>, <code>offset</code>/<code>add</code>). If <code>length</code> was corrupted by safe code, these methods could perform out-of-bounds pointer arithmetic, reads, writes, or copies.</p>
|
||
<p>The upstream maintainer also identified additional soundness issues, including the use of <code>mem::uninitialized</code> in <code>StackVec::from_vec_unchecked</code>, which was reachable through <code>from_vec</code>, and Miri violations related to <code>MaybeUninit</code> usage.</p>
|
||
<p>Version <code>2.0.0</code> was released to fix the known soundness issues.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0194: Vulnerability in quick-xml</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0194.html</id><updated>2026-07-02T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0194.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0194: Vulnerability in quick-xml"/><published>2026-07-02T12:00:00+00:00</published><summary xml:lang="en">Quadratic run time when checking a start tag for duplicate attribute names</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/quick-xml/RUSTSEC-2026-0194.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/quick-xml/RUSTSEC-2026-0194.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0194">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0194
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Quadratic run time when checking a start tag for duplicate attribute names</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-02">
|
||
July 2, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/quick-xml.html">quick-xml</a>
|
||
|
||
(<a href="https://crates.io/crates/quick-xml">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/xml.html">#xml</a>
|
||
|
||
<a href="/keywords/parser.html">#parser</a>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/algorithmic-complexity.html">#algorithmic-complexity</a>
|
||
|
||
<a href="/keywords/quadratic.html">#quadratic</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/issues/969">
|
||
https://github.com/tafia/quick-xml/issues/969
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/pull/971">
|
||
https://github.com/tafia/quick-xml/pull/971
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/commit/07f3db8343cf152f5bc3483ef5b3164582489bea">
|
||
https://github.com/tafia/quick-xml/commit/07f3db8343cf152f5bc3483ef5b3164582489bea
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.41.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>BytesStart::attributes()</code> returns an <code>Attributes</code> iterator which, by default
|
||
(<code>with_checks(true)</code>), rejects a start tag that repeats an attribute name. For
|
||
each attribute yielded, the iterator compared the new name against every name
|
||
seen so far in the same tag using a linear scan, so a start tag with <code>N</code>
|
||
distinct attribute names cost <code>O(N²)</code> byte comparisons. There was no bound on
|
||
<code>N</code> other than the size of the buffered start tag.</p>
|
||
<h2>Impact</h2>
|
||
<p>Any code that parses untrusted XML and iterates a start tag's attributes with
|
||
the default duplicate check enabled can be made to spend CPU time quadratic in
|
||
the number of attributes on a single tag. Because the check is pure computation
|
||
with no <code>.await</code>/I/O, an I/O-based timeout on the consumer (for example a read
|
||
or request timeout) cannot interrupt it while it runs.</p>
|
||
<p>Measured cost of a single start tag, release build:</p>
|
||
<p>| Attributes on one tag | Time |
|
||
|---|---|
|
||
| 80,000 | ~6 s |
|
||
| 800,000 | ~10 min |</p>
|
||
<p>The cost grows with the square of the attribute count, so a start tag of a few
|
||
tens of megabytes can stall a parsing thread for hours. No memory is exhausted
|
||
and the parser does not crash; the effect is CPU exhaustion on the thread doing
|
||
the parsing: a single crafted start tag can pin a CPU core for minutes to hours,
|
||
denying service to that worker. A deployment that places a wall-clock bound on
|
||
parsing, or confines it to a non-critical thread, may consider the availability
|
||
impact lower.</p>
|
||
<h2>Affected code paths</h2>
|
||
<ul>
|
||
<li><code>BytesStart::attributes()</code> / <code>Attributes</code> iterated with checks enabled (the
|
||
default), and <code>BytesStart::try_get_attribute</code>.</li>
|
||
<li><code>NsReader</code>, which resolves namespaces by iterating a tag's attributes and so
|
||
reaches the same check internally.</li>
|
||
</ul>
|
||
<p>Consumers that iterate attributes with <code>.attributes().with_checks(false)</code> and do
|
||
not use <code>NsReader</code> are not affected.</p>
|
||
<p>This was reported as reachable by a remote, unauthenticated attacker in a
|
||
real-world RPKI relying party (NLnet Labs Routinator) via a crafted RRDP
|
||
<code>snapshot.xml</code>.</p>
|
||
<h2>Remediation</h2>
|
||
<p>Upgrade to <code>quick-xml &gt;= 0.41.0</code>, where the duplicate check keeps the linear
|
||
scan for start tags with a small number of attributes and switches to an <code>O(1)</code>
|
||
hash pre-filter above a threshold, making the whole tag <code>O(N)</code>. The reported
|
||
<code>AttrError::Duplicated</code> positions are unchanged.</p>
|
||
<p>If upgrading is not possible and duplicate-name detection is not required,
|
||
disable it with <code>.attributes().with_checks(false)</code> (this does not help
|
||
<code>NsReader</code> consumers, which have no equivalent opt-out before 0.41.0).</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0195: Vulnerability in quick-xml</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0195.html</id><updated>2026-07-02T12:00:00+00:00</updated><category term="denial-of-service"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0195.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0195: Vulnerability in quick-xml"/><published>2026-07-02T12:00:00+00:00</published><summary xml:lang="en">Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/quick-xml/RUSTSEC-2026-0195.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/quick-xml/RUSTSEC-2026-0195.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0195">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0195
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Unbounded namespace-declaration allocation in <code>NsReader</code> enables memory-exhaustion denial of service</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-07-02">
|
||
July 2, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/quick-xml.html">quick-xml</a>
|
||
|
||
(<a href="https://crates.io/crates/quick-xml">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/denial-of-service.html">denial-of-service</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/xml.html">#xml</a>
|
||
|
||
<a href="/keywords/parser.html">#parser</a>
|
||
|
||
<a href="/keywords/dos.html">#dos</a>
|
||
|
||
<a href="/keywords/memory.html">#memory</a>
|
||
|
||
<a href="/keywords/namespace.html">#namespace</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/issues/970">
|
||
https://github.com/tafia/quick-xml/issues/970
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/tafia/quick-xml/commit/7ca25266e94987210daa864889ab15c9332c8a2a">
|
||
https://github.com/tafia/quick-xml/commit/7ca25266e94987210daa864889ab15c9332c8a2a
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>7.5 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.41.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p><code>NsReader</code> resolves namespaces by calling <code>NamespaceResolver::push</code> for every
|
||
<code>Start</code>/<code>Empty</code> event <em>before</em> the event is returned to the caller. <code>push</code>
|
||
iterated all <code>xmlns</code> / <code>xmlns:*</code> attributes on the start tag and, for each one,
|
||
appended the prefix bytes to an internal buffer and pushed a <code>NamespaceBinding</code>
|
||
(32 bytes on 64-bit) to an internal <code>Vec</code>, with no upper bound on the number of
|
||
declarations.</p>
|
||
<h2>Impact</h2>
|
||
<p>A start tag with <code>N</code> namespace declarations drove roughly <code>3×</code> the tag's byte
|
||
size in <code>NamespaceResolver</code> heap, allocated <em>inside</em> <code>quick-xml</code> before the
|
||
<code>NsReader</code> consumer ever received the event and could inspect or reject it. A
|
||
consumer that bounds its <em>input</em> size therefore still cannot bound this
|
||
allocation: an <code>M</code>-byte start tag yields on the order of <code>3 × M</code> bytes of
|
||
resolver heap the caller never sees.</p>
|
||
<p>On untrusted XML this lets a remote, unauthenticated attacker force large heap
|
||
allocations with a single start tag. With several <code>NsReader</code>s running
|
||
concurrently on independent inputs (a common server pattern), the allocations
|
||
stack and can exhaust process memory, causing the operating system to kill the
|
||
process (OOM). This was confirmed against a real-world RPKI relying party (NLnet
|
||
Labs Routinator), where concurrent RRDP validation workers parsing a crafted
|
||
<code>snapshot.xml</code> exceeded the memory limit and the process was OOM-killed.</p>
|
||
<h2>Affected code paths</h2>
|
||
<p>Consumers using <code>NsReader</code> (which always calls <code>NamespaceResolver::push</code> before
|
||
yielding <code>Start</code>/<code>Empty</code>), or calling <code>NamespaceResolver::push</code> directly. A plain
|
||
<code>Reader</code> that does not perform namespace resolution is not affected.</p>
|
||
<h2>Remediation</h2>
|
||
<p>Upgrade to <code>quick-xml &gt;= 0.41.0</code>. <code>NamespaceResolver::push</code> now rejects a start
|
||
tag that declares more than <code>DEFAULT_MAX_DECLARATIONS_PER_ELEMENT</code> (256)
|
||
namespace bindings, returning the new <code>NamespaceError::TooManyDeclarations</code>
|
||
instead of allocating without limit. The limit is configurable via
|
||
<code>NamespaceResolver::set_max_declarations_per_element</code> (use <code>usize::MAX</code> to
|
||
restore the previous unbounded behavior), and <code>NsReader::resolver_mut()</code> is
|
||
provided to reach it.</p>
|
||
<p>There is no clean workaround for <code>NsReader</code> consumers before 0.41.0, as the
|
||
allocation happens inside the reader with no configuration knob to cap it.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0193: Vulnerability in ammonia</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0193.html</id><updated>2026-07-01T12:00:00+00:00</updated><category term="format-injection"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0193.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0193: Vulnerability in ammonia"/><published>2026-06-30T12:00:00+00:00</published><summary xml:lang="en">mXSS in ammonia via MathML `annotation-xml` encoding strip</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/ammonia/RUSTSEC-2026-0193.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/ammonia/RUSTSEC-2026-0193.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0193">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0193
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>mXSS in ammonia via MathML <code>annotation-xml</code> encoding strip</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-30">
|
||
June 30, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-30">
|
||
June 30, 2026
|
||
</time>
|
||
|
||
<time datetime="2026-07-01">
|
||
(last modified: July 1, 2026)
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/ammonia.html">ammonia</a>
|
||
|
||
(<a href="https://crates.io/crates/ammonia">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/format-injection.html">format-injection</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/html.html">#html</a>
|
||
|
||
<a href="/keywords/xss.html">#xss</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-9jh8-v38h-cvhr">GHSA-9jh8-v38h-cvhr</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=4.1.3</code></li>
|
||
|
||
<li><code>&#62;=4.0.2, &#60;4.1.0</code></li>
|
||
|
||
<li><code>&#62;=3.3.2, &#60;4.0.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser.</p>
|
||
<p>The <code>annotation-xml</code> tag has slightly different behavior than the other &quot;integration point&quot;
|
||
tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly
|
||
strip the namespace-incompatible tags.</p>
|
||
<p>This vulnerability only has an effect when the <code>math</code> and <code>annotation-xml</code> tags
|
||
are both enabled, but the <code>encoding</code> attribute is disabled, because it relies
|
||
on the following sequence of steps:</p>
|
||
<ol>
|
||
<li>User writes code like <code>&lt;math&gt;&lt;annotation-xml encoding=&quot;text/html&quot;&gt;&lt;gadget&gt;&lt;/annotation-xml&gt;&lt;/math&gt;</code>.</li>
|
||
<li>Namespace filtering checks the DOM, and it passes. <code>&lt;gadget&gt;</code> is parsed as HTML.</li>
|
||
<li>Attribute filter strips it down to <code>&lt;math&gt;&lt;annotation-xml&gt;&lt;gadget&gt;&lt;/annotation-xml&gt;&lt;/math&gt;</code>. Because the encoding attribute is gone, <code>&lt;gadget&gt;</code> is now parsed as MathML.</li>
|
||
<li>The gadget is written in such a way that it exploits the parsing differences between HTML and MathML.</li>
|
||
</ol>
|
||
<p>Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML.
|
||
These <a href="https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs">elements</a> are:</p>
|
||
<ul>
|
||
<li>title</li>
|
||
<li>textarea</li>
|
||
<li>xmp</li>
|
||
<li>iframe</li>
|
||
<li>noembed</li>
|
||
<li>noframes</li>
|
||
<li>plaintext</li>
|
||
<li>noscript</li>
|
||
<li>style</li>
|
||
<li>script</li>
|
||
</ul>
|
||
<p>Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.</p>
|
||
<hr />
|
||
<p><strong>Discovered by:</strong> ivan0912 (YesWeHack) · <strong>Date:</strong> 2026-06-29 · Found via local differential analysis and source review of ammonia's sanitisation pipeline; no third-party systems were tested.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0192: ttf-parser is unmaintained</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0192.html</id><updated>2026-06-29T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0192.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0192: ttf-parser is unmaintained"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">`ttf-parser` is unmaintained</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/ttf-parser/RUSTSEC-2026-0192.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/ttf-parser/RUSTSEC-2026-0192.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0192">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0192
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>ttf-parser</code> is unmaintained</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-28">
|
||
June 28, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/ttf-parser.html">ttf-parser</a>
|
||
|
||
(<a href="https://crates.io/crates/ttf-parser">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unmaintained
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/harfbuzz/ttf-parser/issues/217">
|
||
https://github.com/harfbuzz/ttf-parser/issues/217
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>The author of <code>ttf-parser</code> has stated that the crate is unmaintained and will not receive further fixes (see the referenced issue).</p>
|
||
<h2>Alternative(s)</h2>
|
||
<ul>
|
||
<li><a href="https://crates.io/crates/skrifa"><code>skrifa</code></a>, an actively maintained TrueType and OpenType font parsing crate, part of the Google Fonts &quot;oxidize&quot; (<code>fontations</code>) project.</li>
|
||
</ul>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0188: Vulnerability in wasmtime-wasi</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0188.html</id><updated>2026-06-29T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0188.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0188: Vulnerability in wasmtime-wasi"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">WASI hard links and renames bypass wasmtime-wasi&apos;s FilePerms for destination</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/wasmtime-wasi/RUSTSEC-2026-0188.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/wasmtime-wasi/RUSTSEC-2026-0188.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0188">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0188
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-24">
|
||
June 24, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/wasmtime-wasi.html">wasmtime-wasi</a>
|
||
|
||
(<a href="https://crates.io/crates/wasmtime-wasi">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-4ch3-9j33-3pmj">GHSA-4ch3-9j33-3pmj</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj">
|
||
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>6.5 <span class="tag medium">
|
||
MEDIUM
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Local</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Changed</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>None</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=46.0.1</code></li>
|
||
|
||
<li><code>&#62;=45.0.3, &#60;46.0.0</code></li>
|
||
|
||
<li><code>&#62;=36.0.12, &#60;37.0.0</code></li>
|
||
|
||
<li><code>&#62;=24.0.11, &#60;25.0.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>This is an entry in the RustSec database for the Wasmtime security advisory
|
||
located at
|
||
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-4ch3-9j33-3pmj
|
||
For more information see the GitHub-hosted security advisory.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0189: Vulnerability in rmcp</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0189.html</id><updated>2026-06-30T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2026-0189.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0189: Vulnerability in rmcp"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">DNS rebinding vulnerability in rmcp Streamable HTTP server transport</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/rmcp/RUSTSEC-2026-0189.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/rmcp/RUSTSEC-2026-0189.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0189">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0189
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>DNS rebinding vulnerability in rmcp Streamable HTTP server transport</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-04-29">
|
||
April 29, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
<time datetime="2026-06-30">
|
||
(last modified: June 30, 2026)
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/rmcp.html">rmcp</a>
|
||
|
||
(<a href="https://crates.io/crates/rmcp">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
Vulnerability
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/dns-rebinding.html">#dns-rebinding</a>
|
||
|
||
<a href="/keywords/mcp.html">#mcp</a>
|
||
|
||
<a href="/keywords/http.html">#http</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="aliases">Aliases</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42559">CVE-2026-42559</a>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-89vp-x53w-74fx">GHSA-89vp-x53w-74fx</a>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-fvh2-gm75-j4j7">GHSA-fvh2-gm75-j4j7</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx">
|
||
https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/pull/764">
|
||
https://github.com/modelcontextprotocol/rust-sdk/pull/764
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/issues/815">
|
||
https://github.com/modelcontextprotocol/rust-sdk/issues/815
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/modelcontextprotocol/rust-sdk/issues/822">
|
||
https://github.com/modelcontextprotocol/rust-sdk/issues/822
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning">
|
||
https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="related">Related</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
|
||
<a href="https://github.com/advisories/GHSA-fvh2-gm75-j4j7">GHSA-fvh2-gm75-j4j7</a>
|
||
|
||
</li>
|
||
|
||
<li>
|
||
|
||
<a href="https://rustsec.org/advisories/RUSTSEC-2026-0140">RUSTSEC-2026-0140</a>
|
||
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="cvss_score">CVSS Score</dt>
|
||
<dd>8.8 <span class="tag high">
|
||
HIGH
|
||
</span></dd>
|
||
|
||
<dt id="cvss_details">CVSS Details</dt>
|
||
<dd>
|
||
<dl>
|
||
|
||
<dt>Attack Vector</dt>
|
||
<dd>Network</dd>
|
||
|
||
<dt>Attack Complexity</dt>
|
||
<dd>Low</dd>
|
||
|
||
<dt>Privileges Required</dt>
|
||
<dd>None</dd>
|
||
|
||
<dt>User Interaction</dt>
|
||
<dd>Required</dd>
|
||
|
||
<dt>Scope</dt>
|
||
<dd>Unchanged</dd>
|
||
|
||
<dt>Confidentiality Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
<dt>Integrity Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
<dt>Availability Impact</dt>
|
||
<dd>High</dd>
|
||
|
||
</dl>
|
||
</dd>
|
||
|
||
<dt id="cvss">CVSS Vector</dt>
|
||
|
||
|
||
<dd><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</a></dd>
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=1.4.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Prior to version 1.4.0, the <code>rmcp</code> crate's Streamable HTTP server transport did
|
||
not validate the incoming <code>Host</code> header.</p>
|
||
<p>This allowed a malicious public website, via a DNS rebinding attack, to send
|
||
requests to an MCP server running on the victim's loopback or private-network
|
||
interface.</p>
|
||
<p>An attacker who convinced a victim to visit a malicious page could enumerate and
|
||
invoke tools exposed by a locally running rmcp-based MCP server, read resources
|
||
and prompts, and trigger side effects limited by the tools exposed by that
|
||
server.</p>
|
||
<p>Non-HTTP transports such as stdio and child-process transports are not affected.</p>
|
||
<h2>Patches</h2>
|
||
<p>The issue was fixed in <code>rmcp</code> 1.4.0 by adding default loopback-only host
|
||
allowlist validation for the Streamable HTTP server transport. Incoming HTTP
|
||
requests now validate the <code>Host</code> header and return HTTP 403 when the host is not
|
||
allowed.</p>
|
||
<p>Users should upgrade to <code>rmcp &gt;= 1.4.0</code>.</p>
|
||
<h2>Workarounds</h2>
|
||
<p>If upgrading is not possible, place the MCP server behind a reverse proxy
|
||
configured to reject requests whose <code>Host</code> header is not one of the expected
|
||
hostnames. Do not bind the MCP server to <code>0.0.0.0</code> without such validation.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0190: Unsoundness in anyhow</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0190.html</id><updated>2026-06-29T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0190.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0190: Unsoundness in anyhow"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">Unsoundness in `Error::downcast_mut()`</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/anyhow/RUSTSEC-2026-0190.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/anyhow/RUSTSEC-2026-0190.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0190">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0190
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>Unsoundness in <code>Error::downcast_mut()</code></p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-06-25">
|
||
June 25, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/anyhow.html">anyhow</a>
|
||
|
||
(<a href="https://crates.io/crates/anyhow">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/unsound.html">#unsound</a>
|
||
|
||
<a href="/keywords/downcast_mut.html">#downcast_mut</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/dtolnay/anyhow/issues/451">
|
||
https://github.com/dtolnay/anyhow/issues/451
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=1.0.103</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>anyhow::Error::downcast_mut</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;1.0.103</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of this crate violate borrow rules, resulting in undefined behavior, when the user adds context to an error via <code>Error::context</code> and then later calls <code>Error::downcast_mut</code> on the returned <code>Error</code>.</p>
|
||
<p>The flaw was corrected in commit <code>6e8c000</code> by revising how the mutable reference is constructed, avoiding inclusion of a shared reference in the resulting borrow chain.</p>
|
||
<h2>Example</h2>
|
||
<pre><code class="language-rust">use anyhow::Error;
|
||
use std::fmt;
|
||
|
||
#[derive(Debug)]
|
||
struct ErrorContext(&amp;'static str);
|
||
|
||
impl fmt::Display for ErrorContext {
|
||
fn fmt(&amp;self, f: &amp;mut fmt::Formatter&lt;'_&gt;) -&gt; fmt::Result {
|
||
fmt::Display::fmt(&amp;self.0, f)
|
||
}
|
||
}
|
||
|
||
fn main() {
|
||
let mut error = Error::msg(&quot;inner error&quot;).context(ErrorContext(&quot;old context&quot;));
|
||
let context: &amp;mut ErrorContext = error.downcast_mut().unwrap();
|
||
context.0 = &quot;new context&quot;;
|
||
println!(&quot;{:?}&quot;, error);
|
||
}
|
||
</code></pre>
|
||
<h2>Miri output</h2>
|
||
<pre><code>error: Undefined Behavior: trying to retag from &lt;1538&gt; for Unique permission at alloc602[0x38], but that tag only grants SharedReadOnly permission for this location
|
||
--&gt; src/ptr.rs:170:18
|
||
|
|
||
170 | unsafe { &amp;mut *self.ptr.as_ptr() }
|
||
| ^^^^^^^^^^^^^^^^^^^^^^^ this error occurs as part of retag at alloc602[0x38..0x48]
|
||
|
|
||
= help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
|
||
= help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
|
||
help: &lt;1538&gt; was created by a SharedReadOnly retag at offsets [0x38..0x48]
|
||
--&gt; src/ptr.rs:89:18
|
||
|
|
||
89 | ptr: NonNull::from(ptr),
|
||
| ^^^^^^^^^^^^^^^^^^
|
||
= note: stack backtrace:
|
||
0: anyhow::ptr::Mut::&lt;'_, ErrorContext&gt;::deref_mut
|
||
at src/ptr.rs:170:18: 170:41
|
||
1: anyhow::error::&lt;impl anyhow::Error&gt;::downcast_mut::&lt;ErrorContext&gt;
|
||
at src/error.rs:560:18: 560:46
|
||
2: main
|
||
at examples/downcast_mut.rs:15:38: 15:58
|
||
</code></pre>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2025-0165: Unsoundness in i_tree</title><id>https://rustsec.org/advisories/RUSTSEC-2025-0165.html</id><updated>2026-06-29T12:00:00+00:00</updated><link href="https://rustsec.org/advisories/RUSTSEC-2025-0165.html" rel="alternate" type="text/html" title="RUSTSEC-2025-0165: Unsoundness in i_tree"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">i_tree allowed out-of-bounds access through safe public node accessors</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/i_tree/RUSTSEC-2025-0165.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/i_tree/RUSTSEC-2025-0165.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2025-0165">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2025-0165
|
||
|
||
</h1>
|
||
<span class="subtitle"><p>i_tree allowed out-of-bounds access through safe public node accessors</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2025-07-04">
|
||
July 4, 2025
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/i_tree.html">i_tree</a>
|
||
|
||
(<a href="https://crates.io/crates/i_tree">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/iShape-Rust/iTree/issues/1">
|
||
https://github.com/iShape-Rust/iTree/issues/1
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/iShape-Rust/iTree/commit/a948b891cf159233bfed5b16bf185268fd9e1985">
|
||
https://github.com/iShape-Rust/iTree/commit/a948b891cf159233bfed5b16bf185268fd9e1985
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://github.com/iShape-Rust/iTree/compare/0.9.0...0.10.0">
|
||
https://github.com/iShape-Rust/iTree/compare/0.9.0...0.10.0
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.10.0</code></li>
|
||
|
||
</ul>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>i_tree::tree::Tree::mut_node</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.10.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
<dt><code>i_tree::tree::Tree::node</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.10.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of <code>i_tree</code> exposed safe public <code>Tree::node</code> and <code>Tree::mut_node</code> methods in the public <code>tree</code> module. These methods accepted an arbitrary <code>u32</code> index and passed it directly to <code>Vec::get_unchecked</code> / <code>get_unchecked_mut</code> on the internal node buffer, without validating that the index was in bounds.</p>
|
||
<p>Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any <code>unsafe</code> code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.</p>
|
||
<p>Starting with <code>0.10.0</code> the crate was restructured and these accessors are no longer reachable from outside the crate.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry><entry><title>RUSTSEC-2026-0191: Unsoundness in solana_rbpf</title><id>https://rustsec.org/advisories/RUSTSEC-2026-0191.html</id><updated>2026-06-29T12:00:00+00:00</updated><category term="memory-corruption"/><link href="https://rustsec.org/advisories/RUSTSEC-2026-0191.html" rel="alternate" type="text/html" title="RUSTSEC-2026-0191: Unsoundness in solana_rbpf"/><published>2026-06-29T12:00:00+00:00</published><summary xml:lang="en">`EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic</summary><content xml:lang="en" type="html"> <article>
|
||
|
||
<span class="floating-menu">
|
||
<a href="https://github.com/RustSec/advisory-db/commits/main/crates/solana_rbpf/RUSTSEC-2026-0191.md">History</a> ⋅
|
||
<a href="https://github.com/RustSec/advisory-db/edit/main/crates/solana_rbpf/RUSTSEC-2026-0191.md">Edit</a> ⋅
|
||
<a href="https://api.osv.dev/v1/vulns/RUSTSEC-2026-0191">JSON (OSV)</a>
|
||
</span>
|
||
|
||
|
||
<header>
|
||
<h1>
|
||
|
||
RUSTSEC-2026-0191
|
||
|
||
</h1>
|
||
<span class="subtitle"><p><code>EbpfVm::invoke_function</code> performs out-of-bounds pointer arithmetic</p>
|
||
</span>
|
||
</header>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt id="reported">Reported</dt>
|
||
<dd>
|
||
<time datetime="2026-05-28">
|
||
May 28, 2026
|
||
</time>
|
||
</dd>
|
||
|
||
<dt id="issued">Issued</dt>
|
||
<dd>
|
||
<time datetime="2026-06-29">
|
||
June 29, 2026
|
||
</time>
|
||
|
||
</dd>
|
||
|
||
<dt id="package">Package</dt>
|
||
<dd>
|
||
|
||
|
||
<a href="/packages/solana_rbpf.html">solana_rbpf</a>
|
||
|
||
(<a href="https://crates.io/crates/solana_rbpf">crates.io</a>)
|
||
|
||
|
||
|
||
</dd>
|
||
|
||
<dt id="type">Type</dt>
|
||
<dd>
|
||
|
||
<span class="tag info">INFO</span>
|
||
Unsound
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="categories">Categories</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><a href="/categories/memory-corruption.html">memory-corruption</a></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
<dt id="keywords">Keywords</dt>
|
||
<dd>
|
||
|
||
<a href="/keywords/soundness.html">#soundness</a>
|
||
|
||
<a href="/keywords/pointer-arithmetic.html">#pointer-arithmetic</a>
|
||
|
||
<a href="/keywords/out-of-bounds.html">#out-of-bounds</a>
|
||
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="details">References</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li>
|
||
<a href="https://github.com/solana-labs/rbpf">
|
||
https://github.com/solana-labs/rbpf
|
||
</a>
|
||
</li>
|
||
|
||
|
||
<li>
|
||
<a href="https://github.com/anza-xyz/sbpf/pull/151">
|
||
https://github.com/anza-xyz/sbpf/pull/151
|
||
</a>
|
||
</li>
|
||
|
||
<li>
|
||
<a href="https://crates.io/crates/solana-sbpf">
|
||
https://crates.io/crates/solana-sbpf
|
||
</a>
|
||
</li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<dt id="patched">Patched</dt>
|
||
<dd>
|
||
|
||
no patched versions
|
||
|
||
</dd>
|
||
|
||
|
||
<dt id="unaffected">Unaffected</dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#60;0.8.0</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
<dl>
|
||
<dt>Affected Functions</dt>
|
||
<dd>Version</dd>
|
||
|
||
<dt><code>solana_rbpf::vm::EbpfVm::invoke_function</code></dt>
|
||
<dd>
|
||
<ul>
|
||
|
||
<li><code>&#62;=0.8.0, &#60;=0.8.5</code></li>
|
||
|
||
</ul>
|
||
</dd>
|
||
|
||
</dl>
|
||
|
||
|
||
|
||
|
||
<h3 id="description">Description</h3>
|
||
<p>Affected versions of <code>solana_rbpf</code> expose the safe method
|
||
<code>EbpfVm::invoke_function</code>. This method computes an obfuscated VM pointer by
|
||
casting <code>self</code> to <code>*mut u64</code> and applying a randomized offset derived from
|
||
<code>get_runtime_environment_key()</code>.</p>
|
||
<p>The resulting pointer arithmetic is performed with <code>ptr::offset</code>, which
|
||
requires the computed pointer to remain within the same allocation. In practice,
|
||
the randomized offset can move the pointer far outside the allocation
|
||
containing the <code>EbpfVm</code>, causing undefined behavior before the supplied builtin
|
||
function is invoked.</p>
|
||
<h2>Unmaintained</h2>
|
||
<p>The upstream <code>solana_rbpf</code> repository is archived, and no patched version of
|
||
this crate is currently available.</p>
|
||
<p>Users should migrate to the maintained <a href="https://crates.io/crates/solana-sbpf"><code>solana-sbpf</code></a>
|
||
crate. The issue has been fixed there in
|
||
<a href="https://github.com/anza-xyz/sbpf/pull/151"><code>anza-xyz/sbpf#151</code></a>.</p>
|
||
|
||
|
||
<p id="license" class="license">Advisory available under <a href="https://spdx.org/licenses/CC0-1.0.html">CC0-1.0</a>
|
||
license.
|
||
|
||
|
||
</p>
|
||
</article></content></entry></feed> |