Skip to content
Threat Feed

Vendor

Rust

3 briefs RSS
high advisory

rust-openssl Unchecked Callback Length Memory Leak

The rust-openssl crate versions 0.9.24 prior to 0.10.78 are vulnerable to memory leaks due to unchecked callback lengths in PSK/cookie trampolines, potentially leading to buffer overflows.

openssl rust memory leak buffer overflow
2r
medium advisory

russh Keyboard-Interactive Authentication Denial-of-Service

A denial-of-service vulnerability exists in the russh crate, where a malicious client can crash any russh-based server implementing keyboard-interactive authentication by sending a crafted SSH_MSG_USERAUTH_INFO_RESPONSE message with a large response count, leading to excessive memory allocation and an out-of-memory crash without requiring any credentials.

russh denial-of-service keyboard-interactive
2r 2t
medium advisory

rustls-webpki Denial-of-Service Vulnerability via Malformed CRL BIT STRING

A denial-of-service vulnerability exists in rustls-webpki versions prior to 0.103.13 and between 0.104.0-alpha.1 and 0.104.0-alpha.7 due to a panic in `bit_string_flags()` when processing a malformed CRL BIT STRING, triggered when CRL checking is enabled and an attacker provides a crafted CRL.

rustls-webpki denial-of-service crl
2r 1t