WaveFormat::parse reads past the end of a &WAVEFORMATEX

Auto-Reseeding HMAC-DRBG could panic for some output lengths

Hybrid Encapsulation from Seed Panics on Short Seed

Panic on Decoding Short Hybrid Keys

parse_arguments reads a caller-supplied pointer as a slice

decompress: tar-family extractors write archive entries without a path-traversal check (tar-slip)

Wasmtime wasi:http implementation panics with a zero timeout supplied

fd_readdir copies uninitialized struct padding into guest memory

Excessive allocated memory on the host when guests don't have stdio

Guest can panic host through filesystem timestamp before the epoch on wasip3

WASI preview 0 implementation of poll_oneoff circumvents fuel consumption

anymap2 is unmaintained

Rooting for GC values live across try_call may be missing, causing GC heap corruption

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

Mis-typed WebAssembly tag imports can lead to GC heap corruption

A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Sending custom to-device messages may panics

Outgoing HTTP body write allows guest-driven host memory exhaustion

Guest can panic host through filesystem datetime overflow

Dynamic record lifting can allocate beyond the hostcall fuel limit

call_ref and exception catch can drop some fuel accounting, leading to exponential fuel amplification

Excluded iPAddress name constraints with an all-zero mask are not applied

Stack overflow on deeply nested LaTeX input

SinglyLinkedList::remove dereferences a null link

Various panics, soundness and resource exhaustion issues

Use-after-free in interned values and cached function results

uncbv: archive extraction is vulnerable to path traversal (zip-slip)

Finished streaming calls keep reading a stalled request body indefinitely

hex_decode_unchecked AVX2 path reads past src

Use-after-free when XML includes have duplicated entities

Use-after-free when a future's Drop panics while the container is dropped

Use-after-free in clear and retain when an element's Drop panics

stack-graphs is archived and unmaintained

stack-graphs C API exports are safe extern "C" functions

Double free in StackVec::retain when a predicate or element Drop panics

owned-alloc is unmaintained

Unsoundness in UTF-8 'String' trait

Memory corruption bug on ApplyResult type

Double free / use-after-free in Chunk and InlineArray removal methods when an element's Drop panics

unzip: archive extraction is vulnerable to path traversal (zip-slip)

unzip is unmaintained

Double free / use-after-free in Consumer::skip and Consumer::clear when an element's Drop panics

Double free in OwnedAlloc::drop_in_place when the contained value's Drop panics

pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery

pqc_kyber is unmaintained

cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery

cosmian_kyber is unmaintained

Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS

Double free in Map::into_iter and an uninitialized Arc in SharedIncin::clear

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

clear_on_drop is unmaintained

Double free in AlignedBox<[T]>::realloc_with_default when an element's Drop panics

greentic-setup 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

greentic-setup-dev 1.3.34027618345 was removed from crates.io due to containing malicious code

Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

Path traversal in apimock's file-serving fallback

Path traversal in apimock-server's file-serving fallback

zbus_polkit: authorization bypass via PID reuse

Legacy azure_core writes the authorization header value to logs

Double free / use-after-free in ReadChunk::commit when an element's Drop panics

Stubbed cryptography without warnings

zip-extract is unmaintained; use the zip >= 2.4.0 crate instead

sp-sized-chunks is unmaintained

Guest controlled-size host heap allocation through WASIp3 streams

Filesystem sandbox escape when paths or symlinks contain trailing slashes

soundness issue

FTP command injection via CRLF in control channel arguments

Panic-safety unsoundness in Stack::pop, Fifo::pop_front and Value::replace_stable (use-after-free / double-free)

Panic-safety unsoundness in BitVecCore::clear (double-free / use-after-free)

arone was removed from crates.io due to malicious code

append-only-vec 0.1.9 was removed from crates.io due to a malicious dependency

aronenao was removed from crates.io due to malicious code

proc-macro1 was removed from crates.io due to malicious code

internment 0.8.7 was removed from crates.io due to a malicious dependency

tinymember was removed from crates.io due to affiliation with malicious code

proc-macro-en was removed from crates.io due to malicious code

arrayref 0.3.10 was removed from crates.io due to a malicious dependency

h2 unbounded empty DATA frames

Panic-safety unsoundness in Chunk and InlineArray (use-after-free / double-free)

Unix BROWSER handling allows browser argument injection

Panic-safety unsoundness in truncate_back, truncate_front, clear, and extend_from_slice (use-after-free / double-free)

Panic-safety unsoundness in Chunk, RingBuffer, and InlineArray (use-after-free / double-free)

hugepage_rs::dealloc may allow invalid memory deallocation from safe code

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

FormatContext stream accessors can cause undefined behavior from safe code

Potential use-after-free due to lack of panic safety in LruCache::pop()

Panic-safety unsoundness in SplitVec::extend_from_slice (uninitialized read)

bitmaps is unmaintained

Bitmap::try_from(&[u8]) can create invalid values

Aliasing violation in OrdSet insertion

im is unmaintained

sevenz-rust is unmaintained

Relative/Absolute Path Traversal (CWE-23/CWE-36) in decompress_impl that enables an arbitrary file write.

smartstring is unmaintained

sized-chunks is unmaintained

im-rc is unmaintained

nostr-relay-builder is unmaintained

Low-level GCM ignores the operation nonce

setlocale and TextDomain::init are unsound as they access environment with no synchronization

Safe ErrorRegistry APIs can cause undefined behavior

nostr-keyring is unmaintained

nostr-relay-pool is unmaintained

Streaming AEAD does not authenticate stream structure

Ed25519 identity public keys permit universal signature forgery

A BigInt division panics, and two neighbouring operations answer wrongly in silence

Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Crafted archives can cause a use-after-free during deserialization

Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables

Relay authentication challenges can exhaust memory

Processing of unverified relay events

NIP-44 v2 decryption permits resource exhaustion

Wallet event parsers accept unauthenticated events

NIP-98 authorization parsing permits resource exhaustion

Empty NIP-50 search filters can panic

NIP-04 parsing amplifies malformed ciphertext memory use

Debug output exposes NIP-46 and NIP-60 credentials

Verification cache poisoning allows forged Nostr events to bypass signature validation

event-listener allows !Send tags to cross thread boundaries via StackSlot

Preemption and traps during bulk operations enable breaking internal VM state

Stores can mix up type indices between engines

Uint shift operations: incorrect overflow flags and truncated shift amounts

Remote Denial of Service via malformed NIP-04 IV

Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load

Enum trait allows type confusion when manually implemented

Remote Denial of Service via malformed NIP‑44 v2 payload

smallstr is unmaintained

gumdrop is unmaintained

XSS in ammonia via SVG animate and set animation tags

Potentially Incorrect Output of Constant-Time Swap/Select on Aarch64

AES-GCM did not enforce limits on AAD length

Non-constant time Authentication Tag Check in AES-GCM Decryption

libcrux-aesgcm Renamed to libcrux-aes

Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls

Potential Panic in AVX2 SHAKE-256

rustybuzz is unmaintained

Array::insert violates exception safety if compare function panics, leading to potential Double-Free

tree-sitter-perl-next is unmaintained

Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid

let_cxx_string! uses uninitialized value due to exception safety violations

Panic in bcrypt::verify on non-ASCII hash input

Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Unbounded page slicing from attacker-controlled CSS height causes denial of service

Report::frames_mut allows aliased mutable references

Matrix{2,3,4}::swap_columns can trigger undefined behavior for identical indices

cgmath is unmaintained

Unbounded namespace-declaration allocation in NsReader enables memory-exhaustion denial of service

Quadratic run time when checking a start tag for duplicate attribute names

Multiple soundness issues in stackvector

mXSS in ammonia via MathML annotation-xml encoding strip

WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination

DNS rebinding vulnerability in rmcp Streamable HTTP server transport

EbpfVm::invoke_function performs out-of-bounds pointer arithmetic

Unsoundness in Error::downcast_mut()

ttf-parser is unmaintained

i_tree allowed out-of-bounds access through safe public node accessors

Stack overflow in lopdf via deeply nested PDF objects

DTriangle accessors may read out of bounds in affected versions

structopt is in maintenance mode

Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Unchecked pointer offset in crate memmap2

Potential undefined behavior when calling Remote::list()

Potential undefined behavior with Signature from a buffer-created BlameHunk

Leak in WASIp1 fd_renumber implementation

DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths

Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

Panic decoding a malformed hstore value allows denial of service

Panic on a DataRow with fewer fields than columns allows denial of service

Triton VM Soundness Vulnerability due to Missing Constraint

Out-of-bounds read in nth / nth_back for PyList and PyTuple iterators

Missing Sync bound on PyCFunction::new_closure closures

onering 1.4.1 was removed from crates.io for malicious code

Authorization::value and WwwAuthenticate::value can violate ASCII invariants

proc-macro-error2 is unmaintained

Unsound issue in Trailer

Possible use after free when deserializing a SQLite database via SqliteConnection::deserialize_readonly_database

pqcrypto is unmaintained: upstream PQClean project being archived

pqcrypto-mlkem is unmaintained: upstream PQClean project being archived

pqcrypto-internals is unmaintained: upstream PQClean project being archived

logflux was removed from crates.io for malicious code

Incomplete message edit validation in matrix-sdk-ui

pqcrypto-sphincsplus is unmaintained: upstream PQClean project being archived

pqcrypto-falcon is unmaintained: upstream PQClean project being archived

pqcrypto-traits is unmaintained: upstream PQClean project being archived

pqcrypto-hqc is unmaintained: upstream PQClean project being archived

pqcrypto-mldsa is unmaintained: upstream PQClean project being archived

tide is unmaintained

surf is unmaintained

pqcrypto-classicmceliece is unmaintained: upstream PQClean project being archived

Sender-binding gaps in to-device messages

Several memory corruption issues via safe APIs

Bad-free in MetaCallException::new

exploration was removed from crates.io for malicious code

Unchecked CryptoVec allocation and growth handling

Unbounded 32-bit allocation

Use-after-free

Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

audiopus_sys is unmaintained

WASI path_open(TRUNCATE) bypasses FilePerms::WRITE host restriction

VMABuffer::set_data may allow out-of-bounds writes from safe code

OCI layer symlink escape → arbitrary host write

Read-only volume remount bypass via guest CAP_SYS_ADMIN

InterfaceAccount allows account substitution between unexpected types

PAX Header Desynchronization in astral-tokio-tar

Program<System> accepts arbitrary executable programs

Double-free in vmem storage reachable from safe Rust (predecessor of oneringbuf)

TLS hostname verification disabled when using Boring TLS backend

Double-free in vmem storage reachable from safe Rust

Potential Panic on Overlong Ciphertext Buffer

DNS rebinding and cross-origin CSRF in dynoxide's MCP HTTP transport

Out-of-bounds read/write in Index and IndexMut implementations

Double-free and use-after-free in Keys::next()

Double-free in Chomp::inner()

Invalid pointer arithmetic in iter() and iter_mut()

Integer overflow in array::ReadWrite::new() leading to potential memory corruption

Unsound access to padding bytes while serializing date/time values using the Mysql backend

Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend

Command injection in Diesel's implementation of COPY FROM/COPY TO

Possible unaligned data access for implementations of SqliteAggregate

Null-pointer dereference and double-free via safe APIs

Buffer overflow in Clusterings::from_i32_column_major_order()

Unsound access to padding bytes while serializing date/time values using the Mysql backend

Signature Verification on AVX2 Platforms Mishandles Edge Case

AVX2 Implementation Did Not Fully Reduce Intermediate Values

Out-of-bounds read in bytes_helper public safe functions

Potential use-after-free due to lack of panic safety in InlineVec::clear and SerVec::clear

Denial of service in Steamworks game clients/servers using P2P authentication

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

Improper check of an invariant resulting in incorrect bounds checks

Fragile bounds check when sampling from image

Fragile bounds check when sampling from image

CPU exhaustion during message encoding due to O(n²) name compression

NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses

Panic when allocating a table exceeding the size of the host's address space

PAX Header Desynchronization in astral-tokio-tar

unpack_in can chmod arbitrary directories by following symlinks

Broken hard revocation handling

sui-execution-cut was removed from crates.io for malicious code

Possible UTF-8 corruption in Diesels SQLite backend

mysten-metrics was removed from crates.io for malicious code

bare-metal is deprecated

Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation

Reachable panic in certificate revocation list parsing

core2 is unmaintained, all versions yanked

Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

microsoftsystem64 was removed from crates.io for malicious code

pretty-changelog-logger was removed from crates.io for malicious code

safe-agent-rs was removed from crates.io for being affiliated with malicious code

Name constraints for URI names were incorrectly accepted

Name constraints were accepted for certificates asserting a wildcard name

libsecp256k1 is unmaintained

Rand is unsound with a custom logger using rand::rng()

logprinter was removed from crates.io for malicious code

Out-of-bounds write or crash when transcoding component model strings

Wasmtime segfault or unused out-of-sandbox load with f64x2.splat operator on Cranelift x86-64

Panic when lifting flags component value

Use-after-free bug after cloning wasmtime::Linker

Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access

Panic when transcoding misaligned component model UTF-16 strings

Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Host panic when Winch compiler executes table.fill

Data leakage between pooling allocator instances

Host data leakage with 64-bit tables and Winch

Improperly masked return value from table.grow with Winch compiler backend

zantetsu-ffi is unmaintained

zantetsu-trainer is unmaintained

logtrace was removed from crates.io for malicious code

Logs AWS credentials when TRACE-level logging is enabled

Multiple soundness issues in scaly safe APIs

DynFuture drop can construct a dangling reference

jfrog_quotes was removed from crates.io for malicious code

tree-sitter-pkl was removed from crates.io for malicious code

custom-req-on-workers was removed from crates.io for malicious code

sophosfirewall-python was removed from crates.io for malicious code

Symbol confusion after hasher panic in intaglio interners

statsrelay-protobuf was removed from crates.io for malicious code

winx-rs was removed from crates.io for malicious code

tauri-winrt-notifications was removed from crates.io for malicious code

monero-api was removed from crates.io for malicious code

littest was removed from crates.io for malicious code

monero-rpc-rs was removed from crates.io for malicious code

bit-flags was removed from crates.io for malicious code

windows-service-rs was removed from crates.io for malicious code

tiny-server was removed from crates.io for malicious code

acceptxmr-rs was removed from crates.io for malicious code

lasso-rs was removed from crates.io for malicious code

postgresderive was removed from crates.io for malicious code

windowsservice was removed from crates.io for malicious code

hann-rs-service was removed from crates.io for malicious code

win_run_rs was removed from crates.io for malicious code

win-crypto was removed from crates.io for malicious code

registry-win was removed from crates.io for malicious code

openvpn-plugin-rs was removed from crates.io for malicious code

rands was removed from crates.io for malicious code

win-base64-rs was removed from crates.io for malicious code

libusb1-main was removed from crates.io for malicious code

lfest-main was removed from crates.io for malicious code

tauri-win-rt-notification was removed from crates.io for malicious code

replit_ruspty was removed from crates.io for malicious code

Missing Check for All-Zero X25519 Shared Secret

Nonce Reuse in HPKE Context

Incorrect Length Encoding on KDF Export

Panic When Opening or Sealing on Export-Only Context

All-Zero Key Generation on Catastrophic RNG Failure

Incorrect Output of Incremental Portable SHAKE API

Panic in Standalone MAC Operations

Incorrect Check of Signer Response Norm During Verification

Panic in Signature Hint Decoding During Verification

unpack_in can chmod arbitrary directories by following symlinks

tar-rs incorrectly ignores PAX size headers if header size is nonzero

Insufficient validation of PAX extensions during extraction

tokio-signal is unmaintained

tokio-uds is unmaintained

tokio-io is unmaintained

tokio-tls is unmaintained

tokio-codec is unmaintained

tokio-compat is unmaintained

tokio-threadpool is unmaintained

Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

CRL Distribution Point Scope Check Logic Error in AWS-LC

tokio-executor is unmaintained

tokio-udp is unmaintained

tokio-tcp is unmaintained

CRLs not considered authoritative by Distribution Point due to faulty matching logic

tokio-current-thread is unmaintained

tokio-fs is unmaintained

tokio-process is unmaintained

tokio-reactor is unmaintained

PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN

PKCS7_verify Signature Validation Bypass in AWS-LC

CRL Distribution Point Scope Check Logic Error in AWS-LC

tokio-sync is unmaintained

tokio-timer is unmaintained

lazystatic was removed from crates.io for malicious code

envlogger was removed from crates.io for malicious code

postgress was removed from crates.io for malicious code

xrvrv was removed from crates.io for malicious code

if-cfg was removed from crates.io for malicious code

oncecell was removed from crates.io for malicious code

serd was removed from crates.io for malicious code

Decompressing invalid data can leak information from uninitialized memory or reused output buffer

tracing-ethers was removed from crates.io due to malicious code

chrono_anchor was removed from crates.io due to malicious code

RustSec Advisory

Denial of service in Quinn endpoints

HTTP Request Smuggling via Premature Upgrade

HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

time-sync was removed from crates.io due to malicious code

Cache poisoning via insecure-by-default cache key

dnp3times was removed from crates.io due to malicious code

time_calibrators was removed from crates.io due to malicious code

time_calibrator was removed from crates.io due to malicious code

Double-free and use-after-free for Hive

tracings was removed from crates.io for malicious code

tracing_checks was removed from crates.io for transitively including malicious code

Incorrect X25519 clamping check rejects all secrets on import

Panic in libcrux-psq on decryption of malformed AES-GCM ciphertext

Unnecessary clamping of seed reduces seed entropy to 251 bits

X25519 secret validation did not check buffer length or clamping

rpc-check was removed from crates.io for malicious code

hexchat crate is unsound and unmaintained

Panic adding excessive fields to a wasi:http/types.fields instance

Panic when dropping a [Typed]Func::call_async future

Guest-controlled resource exhaustion in WASI implementations

tracing-check was removed from crates.io for malicious code

clob-sdk was removed from crates.io for malicious code

polymarkets-rs-clob-client was removed from crates.io for malicious code

rpc-check was removed from crates.io for malicious code

polymarkets-client-sdk was removed from crates.io for malicious code

Type confusion when accessing data from sublasses of subclasses of native types with abi3 feature targeting Python 3.12 and up

Unsoundness in opt-in ARMv8 assembly backend for keccak

polymarket-client-sdks was removed from crates.io for malicious code

finch-rst was removed from crates.io for malicious code

sha-rst was removed from crates.io for malicious code

finch_cli_rust was removed from crates.io for malicious code

World Writable Directory in /var/log/below Allows Local Privilege Escalation

polymarket-clients-sdk was removed from crates.io for malicious code

finch-rust was removed from crates.io for malicious code

evm-units was removed from crates.io for malicious code

uniswap-utils was removed from crates.io for malicious code

Denial of Service via Stack Exhaustion

sha-rust was removed from crates.io for malicious code

Potential undefined behavior when dereferencing Buf struct

Integer overflow in BytesMut::reserve

Timing side-channel in ML-DSA decomposition

Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Unsound APIs of public constant::Reader and StructSchema

Potential use-after-free in oneshot when used asynchronously

Triton VM Soundness Vulnerability due to Improper Sampling of Randomness

Use After Free in lucet-runtime

Non-constant-time code generation on ARM32 targets

Segmentation fault and invalid memory read in mnl::cb_run

Bincode is unmaintained

IterMut violates Stacked Borrows by invalidating internal pointer

Potential Undefined Behaviors in Arc<T>/Rc<T> impls of from_value on OOM

Non-utf8 String can be created with TimeBuf::as_str

theshit vulnerable to unsafe loading of user-owned Python rules when running as root

Plaintext exposed in decrypt_in_place_detached even on tag verification failure

--allow-read / --allow-write permission bypass in node:sqlite

Unsoundness of safe reciprocal_mg10

Panics on Malformed Untrusted Input

Shell expansion in custom commands

Invalid Slice Split Results in Server Panic

Incorrect signature verification on gzip-compressed install images

cap-primitives doesn't fully sandbox all the Windows device filenames

Uncaught exception when transitioning the state of AsyncGenerator objects from within a property getter of then

Underflow in aes_key_unwrap function

matrix-sdk-base: Denial of service due to custom m.room.join_rules events

rustls-pemfile is unmaintained

Incorrect calculation on aarch64

Reader::open_mmap unsoundly marks unsafe memmap operation as safe

Lack of sufficient checks in public API

Missing check in ZK proof in CGGMP21 Threshold Signing Protocol

CGGMP21 presignatures can be used in the way that significantly reduces security

Heap-buffer-overflow in nftnl::Batch::with_page_size (nftnl-rs)

Missing check in ZK proof in CGGMP21 Threshold Signing Protocol

CGGMP21 presignatures can be used in the way that significantly reduces security

Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS

rand_os crate is unmaintained

gcc crate is unmaintained

number_prefix crate is unmaintained

cargo-asm crate is unmaintained

opentelemetry-jaeger crate is unmaintained

Unsound API access to a WebAssembly shared linear memory

tandem_http_client is unmaintained

tandem is unmaintained

tandem_http_server is unmaintained

tandem_garble_interop is unmaintained

soundness issue and unmaintained

Possible host crash with host-to-wasm component intrinsics

tokio-tar parses PAX extended headers incorrectly, allows file smuggling

astral-tokio-tar Vulnerable to PAX Header Desynchronization

Uninitialized memory exposure in any_as_u8_slice

Out-of-bounds memory access in binary_read_to_ref and binary_write_from_ref

Uninitialized memory exposure in string reading functions

unic-char-property is unmaintained

unic-cli is unmaintained

unic-ucd-common is unmaintained

unic-char is unmaintained

unic-emoji is unmaintained

unic-ucd-name is unmaintained

unic-char-basics is unmaintained

unic-emoji-char is unmaintained

unic-ucd-name_aliases is unmaintained

unic-segment is unmaintained

unic-ucd-age is unmaintained

unic-ucd-segment is unmaintained

unic-ucd-version is unmaintained

unic-ucd-hangul is unmaintained

Uninitialized memory exposure in create_ring_buffer

unic-normal is unmaintained

unic-ucd-core is unmaintained

unic-ucd-block is unmaintained

unic is unmaintained

unic-char-range is unmaintained

unic-utils is unmaintained

unic-ucd-category is unmaintained

unic-ucd-ident is unmaintained

unic-ucd-bidi is unmaintained

unic-idna is unmaintained

unic-ucd-case is unmaintained

unic-idna-mapping is unmaintained

unic-bidi is unmaintained

unic-idna-punycode is unmaintained

unic-common is unmaintained

Undefined behavior in index_of_ptr with empty slices

unic-ucd-normal is unmaintained

unic-ucd is unmaintained

DoS vulnerability on alloy_dyn_abi::TypedData hashing

soundness issue and unmaintained

Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal

Pingora MadeYouReset HTTP/2 vulnerability

daemonize is Unmaintained

martin-mbtiles has been renamed to mbtiles

serde_yml crate is unsound and unmaintained

libyml::string::yaml_string_extend is unsound and unmaintained

Uninitalized memory read & leak caused by fuser crate

Possible unsound public API

matrix-sdk-base: Panic in the RoomMember::normalized_power_level() method

soundness issue and unmaintained

The google-apis-rs project is now unmaintained

iron crate is unmaintained

Heap Buffer Overflow in the DrainCol Destructor

servo-fontconfig crate is unmaintained

crypto-hash crate is unmaintained

custom_derive crate is unmaintained

adler crate is unmaintained, use adler2 instead

fxhash - no longer maintained

Logging user input may result in poisoning logs with ANSI escape sequences

ArrayQueue::push_front is not panic-safe

Multiple memory corruption vulnerabilities in safe APIs

webp crate may expose memory contents when encoding an image

async-std has been discontinued

xcb::Connection::connect_to_fd* functions violate I/O safety

IdMap::from_iter may lead to uninitialized memory being freed on drop

User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows

tsify-next is unmaintained, use tsify instead

Out-of-bounds access in get_disjoint_mut due to incorrect bounds check

Host panic with fd_renumber WASIp1 function

ConstStaticCell could have been used to pass non-Send values to another thread

Four unique double-free vulnerabilities triggered via safe APIs

matrix-sdk-sqlite: SQL injection vulnerability in SqliteEventCacheStore::find_event_with_relations

Uninitialized read after allocating MemBump

Dump Undefined Memory by JitDumpFile

matrix-sdk-crypto vulnerable to encrypted event sender spoofing by homeserver administrator

root appended to group listings

Lack of sufficient checks in public API

Out of bounds access in public safe API

Pingora Request Smuggling and Cache Poisoning

surf is unmaintained

Multiple soundness issues in macroquad

soundness issue and unmaintained

Public API without sufficient bounds checking

Safe API can cause heap-buffer-overflow

Unsound public API in unmaintained crate

cve-rs introduces memory vulnerabilities in safe Rust

totally-safe introduces memory vulnerabilities in safe Rust

totally-safe-transmute allows transmuting any type to any other type in safe Rust

Runtime crash when combining tail calls with stack traces

Miscompilation of wasm i64x2.shr_s instruction with constant input on x86_64

Data leakage between instances in the pooling allocator

Guest-controlled out-of-bounds read/write on x86_64

Undefined Behavior in Rust runtime functions

Panic when using a dropped extenref-typed element segment

Use after free with externrefs and epoch interruption in Wasmtime

Use After Free with externrefs in Wasmtime

Out of bounds write in wasmtime_trap_code C API function

Miscompilation of i8x16.swizzle and select with v128 inputs

Invalid drop of VMExternRef from partially-initialized instances in the pooling instance allocator

Miscompilation of constant values in division on AArch64

Out of bounds read/write with zero-memory-pages configuration

Wasmtime doesn't fully sandbox all the Windows device filenames

Race condition could lead to WebAssembly control-flow integrity and type safety violations

Miscompilation of i8x16.select with the same inputs on x86_64

Panic in mp3-metadata due to the lack of bounds checking

atomic-polyfill is unmaintained

registry is unmaintained

rustc-serialize is unmaintained

crossbeam-channel: double free on Drop

Broadcast channel calls clone in parallel, but does not require Sync

Use-After-Free in Md::fetch and Cipher::fetch

SHA-1 collision attacks are not detected

Risk of buffer overflow in PyString::from_object

array-init-cursor in version 0.2.0 and below is unsound when used with types that implement Drop

Potential out-of-bounds read with a malformed ELF file and the HashTable API.

The trust-dns project has been rebranded to hickory-dns

Use after free in Parc and Prc due to missing lifetime constraints

Denial of Service via malicious Web Push endpoint

Versions of ring prior to 0.17 are unmaintained.

backoff is unmaintained.

Crash due to uncontrolled recursion in protobuf crate

openpgp-card-sequoia is unmaintained.

resolve is unmaintained

paste - no longer maintained

Some AES functions may panic when overflow checking is enabled.

Openh264 Decoding Functions Heap Overflow Vulnerability

Unsound usages of Vec::from_raw_parts

Hickory DNS failure to verify self-signed RRSIG for DNSKEYs

Out of bounds write triggered by crafted coverage data

ssl::select_next_proto use after free

Segmentation fault due to lack of bound check

Segmentation fault due to lack of bound check

Missing facility to signal rotation of a verified cryptographic identity

gix-worktree-state nonexclusive checkout sets executable files world-writable

Malicious plugin names, recipients, or identities can cause arbitrary binary execution

Malicious plugin names, recipients, or identities can cause arbitrary binary execution

Unsound usages of core::slice::from_raw_parts

Use of insecure cryptographic algorithms

Unsoundness in Iterator and DoubleEndedIterator impls for glib::VariantStrIter

Unsound usages of core::slice::from_raw_parts_mut

Undefined behaviour in kvm_ioctls::ioctls::vm::VmFd::create_device

Unsound usages of u8 type casting

get-size-derive is unmaintained

get-size is unmaintained

gtk-layer-shell-sys GTK3 bindings - no longer maintained

gtk-layer-shell GTK3 bindings - no longer maintained

idna accepts Punycode labels that do not produce any non-ASCII when decoded

Build corruption when using PYO3_CONFIG_FILE environment variable

Unsound usages of std::slice::from_raw_parts

serial crate is unmaintained

Denial of service because of stack overflow with malicious decompression input

op_panic in the base runtime can force a panic in the runtime's containing thread

BTreeMap memory leak when deallocating nodes with overflows

op_panic in the base runtime can force a panic in the runtime's containing thread

Unsoundness in anstream

Borsh serialization of HashMap is non-canonical

Fails to ensure slice elements match the slice's declared type

multi_mut is Unmaintained

ruzstd uninit and out-of-bounds memory reads

rustls network-reachable panic in Acceptor::accept

Bias of Polynomial Coefficients in Secret Sharing

conrod is unmaintained

minitrace is Unmaintained

Ambiguous challenge derivation

Replaced by pqcrypto-mlkem

bcc is unmaintained

conrod_core is unmaintained

cw0 is unmaintained

mmap unmaintained

hwloc is unmaintained

loopdev crate is unmaintained; use 'loopdev-3` instead.

Mimalloc Can Allocate Memory with Bad Alignment

strason is unmaintained

The maintainer of chrono-english is unresponsive

MaybeUninit misuse in simd-json-derive

Replaced by pqcrypto-mldsa

instant is unmaintained

opentelemetry_api has been merged into the opentelemetry crate

Ambiguous challenge derivation

openslide is unmaintained

derivative is unmaintained; consider using an alternative

Ambiguous challenge derivation

Multiple soundness issues

Risk of use-after-free in borrowed reads from Python weak references

Heap Buffer overflow using c_chars_to_str function

Remotely exploitable Denial of Service in Tonic

atty is unmaintained

Segmentation fault due to use of uninitialized memory

Multiple soundness issues

Endpoint::retry() calls can lead to panicking

Memory leak when calling a canister method via ic_cdk::call

gix-path improperly resolves configuration path reported by Git

proc-macro-error is unmaintained

phonenumber: panic on parsing crafted phonenumber inputs

olm-sys: wrapped library unmaintained, potentially vulnerable

gix-path uses local config across repos when it is the highest scope

CWA-2023-004: Excessive number of function parameters in compiled Wasm

Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

gitoxide-core does not neutralize special characters for terminals

Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

Stack overflow when parsing specially crafted JSON ABI strings

CWA-2024-004: Gas mispricing in cosmwasm-vm

XmpFile::close can trigger UB

The kstring integration in gix-attributes is unsound

Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

MemBio::get_buf has undefined behavior with empty buffers

UserIdentity::is_verified not checking verification status of own user identity while performing the check

Usage of non-constant time base64 decoder could lead to leakage of secret key material

gix-path can use a fake program files location

Refs and paths with reserved Windows device names access the devices

Incorrect usage of #[repr(packed)]

Traversal outside working tree enables arbitrary code execution

Incorrect usage of #[repr(packed)]

Refs and paths with reserved Windows device names access the devices

Traversal outside working tree enables arbitrary code execution

Refs and paths with reserved Windows device names access the devices

Traversal outside working tree enables arbitrary code execution

Low severity (DoS) vulnerability in sequoia-openpgp

Timing variability in curve25519-dalek's Scalar29::sub/Scalar52::sub

Reduced entropy due to inadequate character set usage

Degraded secret zeroization capabilities

Tor path lengths too short when "full Vanguards" configured

Tor path lengths too short when "Vanguards lite" configured

Slow loris vulnerability with default configuration

Arithmetic overflows in cosmwasm-std

The crate zip_next has been renamed to zip.

rustls::ConnectionCommon::complete_io could fall into an infinite loop based on network input

gix-transport indirect code execution via malicious username

rsa-export is unmaintained

libp2p-tokio-socks5 is unmaintained

Degradation of service in h2 servers with CONTINUATION Flood

Puccinier is unmainted.

yaml-rust is unmaintained.

HPACK decoder panics on invalid input

Parts of Report are dropped as the wrong type during downcast

hpack is unmaintained

Stack buffer overflow with whoami on several Unix platforms

Tokens for named pipes may be delivered after deregistration

blurhash: panic on parsing crafted blurhash inputs

ObjectPool creates uninitialized memory when freeing objects

phonenumber: panic on parsing crafted RF3966 phonenumber inputs

Non-idiomatic use of iterators leads to use after free

safemem is unmaintained

dav1d AV1 decoder integer overflow

generational-arena is unmaintained

filesystem-rs may be implicitly unmaintained

Buffer overflow due to integer overflow in transpose

KyberSlash: division timings depending on secrets

Unauthenticated Nonce Increment in snow

Stack overflow during recursive JSON parsing

Memory corruption, denial of service, and arbitrary code execution in libgit2

Improper comparison of different-length signatures

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Use-after-free when setting the locale

Multiple issues involving quote API

Unsound sending of non-Send types across threads

cosmwasm is unmaintained

Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

Potential stack use-after-free in Instrumented::into_inner

Unsound use of str::from_utf8_unchecked on bytes which are not UTF-8

serde deserialization for FamStructWrapper lacks bound checks that could potentially lead to out-of-bounds memory access

Remotely exploitable DoS condition in Rosenpass <=0.2.0

Unaligned write of u64 on 32-bit and 16-bit platforms

cpython is unmaintained

Some Ref methods are unsound with some type parameters

Infinite decoding loop through specially crafted payload

openssl X509StoreRef::objects is unsound

Marvin Attack: potential key recovery through timing sidechannels

Insufficient covariance check makes self_cell unsound

sudo-rs: Path Traversal vulnerability

Sequential calls of encryption API (encrypt, wrap, and dump) result in nonce reuse

fehler is unmaintained; use culpa instead

Vulnerable to privilege escalation using ioctls TIOCSTI and TIOCLINUX

Tungstenite allows remote attackers to cause a denial of service

gix-transport code execution vulnerability

Denial of service in Quinn servers

libwebp: OOB write in BuildHuffmanTable

BER/CER/DER decoder panics on invalid input

libwebp: OOB write in BuildHuffmanTable

Unaligned read of *const *const c_char pointer

Exposes reference to non-Sync data to an arbitrary thread

Fails to prohibit standard library access prior to initialization of Rust standard library runtime

Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses

Multiple soundness issues

Use-after-free in vec_insert_bytes

webpki: CPU denial of service in certificate path building

rustls-webpki: CPU denial of service in certificate path building

dlopen_derive is unmaintained

multipart is Unmaintained

Double Public Key Signing Function Oracle Attack on ed25519-dalek

tui is unmaintained; use ratatui instead

Unsoundness in intern methods on intaglio symbol interners

impl FromMdbValue for bool is unsound

Misaligned pointer dereference in ChunkId::new

memoffset allows reading uninitialized memory

openssl X509VerifyParamRef::set_host buffer over-read

ftp is unmaintained, use suppaftp instead

Ouroboros is Unsound

Remote Attackers can cause Denial-of-Service (packet loops) with crafted DNS packets

users crate is unmaintained

Out-of-bounds array access leads to panic

Out-of-bounds array access leads to panic

crate has been renamed to crypto_secretbox

tree_magic is Unmaintained

Adverserial use of make_bitflags! macro can cause undefined behavior

Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

Parsing borsh messages with ZST which are not-copy/clone is unsound

Unsound FFI: Wrong API usage causes write past allocated area

Initialisation failure in Once::try_call_once can lead to undefined behaviour for other initialisers

Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses

TLS certificate common name validation bypass

TLS certificate common name validation bypass

buf_redux is Unmaintained

Gitoxide has renamed its crates.

Gitoxide has renamed its crates.

openssl X509NameBuilder::build returned object is not thread safe

openssl SubjectAlternativeName and ExtendedKeyUsage::other allow arbitrary file read

openssl X509Extension::new and X509Extension::new_nid null pointer dereference

rmp-serde Raw and RawRef unsound

NULL pointer dereference in stb_image

const-cstr is Unmaintained

nphysics2d is unmaintained

boxfnonce obsolete with release of Rust 1.35.0

ncollide3d is unmaintained

encoding is unmaintained

nphysics3d is unmaintained

mach is unmaintained

out_reference::Out::from_raw should be unsafe

ncollide2d is unmaintained

kuchiki is unmaintained

maligned::align_first causes incorrect deallocation

Race Condition Enabling Link Following and Time-of-check Time-of-use (TOCTOU)

tauri filesystem scope partial bypass

Possible out-of-bounds read in release mode

Ascii allows out-of-bounds array indexing in safe code

libsqlite3-sys via C SQLite CVE-2022-35737

Miscompilation in cortex-m-rt 0.7.1 and 0.7.2

pnet_packet buffer overrun in set_payload setters

Double free after calling PEM_read_bio_ex

Use-after-free following BIO_new_NDEF

X.400 address type confusion in X.509 GeneralName

NULL dereference during PKCS7 data verification

X.509 Name Constraints Read Buffer Overflow

NULL dereference validating DSA public key

Timing Oracle in RSA Decryption

Invalid pointer dereference in d2i_PKCS7 functions

aliyun-oss-client secret exposure

tauri's readDir endpoint allows possible enumeration outside of filesystem scope

tokio::io::ReadHalf<T>::unsplit is Unsound

personnummer Input validation error

libp2p Lack of resource management DoS

Slack OAuth Secrets leak in debug logs

Slack Webhooks secrets leak in debug logs

evm incorrect state transition

matrix-sdk Impersonation of room keys

bzip2 Denial of Service (DoS)

Improper validation of Windows paths could lead to directory traversal attack

git2 does not verify SSH keys by default

json is unmaintained

parity-util-mem Unmaintained

ELF header parsing library doesn't check for valid offset

Crate twoway deprecated by the author

claim is Unmaintained

Use-after-free due to a lifetime error in Vec::into_iter()

Bug in Wasmtime implementation of pooling instance allocator

Bug in pooling instance allocator

reject_remote_clients Configuration corruption

Force cast a &Vec to &[T]

Location header incorporates user input, allowing open redirect

crate has been renamed to embedded-alloc

Rusoto is unmaintained

Unsound API in secp256k1 allows use-after-free and invalid deallocation from safe code

out-of-bounds read possible when setting list-of-pointers

Improper validation of Windows paths could lead to directory traversal attack

Potential unaligned read

Invalid use of mem::uninitialized causes use-of-uninitialized-value

Denial of Service from unchecked request length

X.509 Email Address 4-byte Buffer Overflow

X.509 Email Address Variable Length Buffer Overflow

Multiple vulnerabilities resulting in out-of-bounds writes

matrix-sdk 0.6.0 logs access tokens

Crate parity-wasm deprecated by the author

orbtk is Unmaintained

Using a Custom Cipher with NID_undef may lead to NULL encryption

Library exclusively intended to inject UB into safe Rust.

badge is Unmaintained

clipboard is Unmaintained

No default limit put on request bodies

wee_alloc is Unmaintained

typemap is Unmaintained

kamadak-exif DoS with untrusted PNG data

traitobject is Unmaintained

mozjpeg DecompressScanlines::read_scanlines is Unsound

dotenv is Unmaintained

rusttype is Unmaintained

cell-project used incorrect variance when projecting through &Cell<T>

dotenv is Unmaintained

os_socketaddr invalidly assumes the memory layout of std::net::SocketAddr

mapr is Unmaintained

Memory corruption in liblz4

ansi_term is Unmaintained

Interledger is Unmaintained

Use after free in MacOS / iOS implementation

Incorrect use of set_len allows for un-initialized memory

Out-of-bounds read when opening multiple column families with TTL

Post-Quantum Signature scheme Rainbow level I parametersets broken

sodiumoxide is deprecated

Post-Quantum Key Encapsulation Mechanism SIKE broken

Use of uninitialized memory in temporary

Improper validation of Windows paths could lead to directory traversal attack

Unsoundness of AtomicCell<64> arithmetics on 32-bit targets that support Atomic64

malicious crate rustdecimal

project abandoned

Denial of service on deeply nested fragment requests

term_size is unmaintained; use terminal_size instead

Denial of service on deeply nested fragment requests

sass-rs has been deprecated

project abandoned

Multiple soundness issues in owning_ref

Unbounded memory allocation based on untrusted length

Safety issues in pkcs11

AES OCB fails to encrypt some bytes

Heap memory corruption with RSA private key operation

Panic due to improper UTF-8 indexing

Stack overflow during recursive expression parsing

MsQueue push/pop use the wrong orderings

Use after free in Neon external buffers

OCSP_basic_verify may incorrectly verify the response signing certificate

Resource leakage when decoding certificates and keys

Incorrect MAC key used in the RC4-MD5 ciphersuite

double-checked-cell is unmaintained

static_type_map has been renamed to erased_set

SegQueue creates zero value of any type

Parser creates invalid uninitialized value

SegQueue creates zero value of any type

Channel creates zero value of any type

Timing attack

array! macro is unsound when its length is impure constant

Use after free with externrefs and epoch interruption in Wasmtime

pty is unmaintained

Infinite loop in BN_mod_sqrt() reachable when parsing certificates

Regexes with large repetitions on empty sub-expressions take a very long time to parse

Arrow2 allows double free in safe code

Miscomputation when performing AES encryption in rust-crypto

enum_map macro can cause UB when Enum trait is incorrectly implemented

tokio-proto is deprecated/unmaintained

Failure to verify the public key of a SignedEnvelope against the PeerId in a PeerRecord

Delegate functions are missing Send bound

A malicious coder can get unsound access to TCell or TLCell memory

Data race in Iter and IterMut

crate has been renamed to ftdi-embedded-hal

Stack overflow in rustc_serialize when parsing deeply nested JSON

array! macro is unsound in presence of traits that implement methods it calls internally

Time-of-check time-of-use race condition can allow attacker to delete files they do not have access to delete

Space bug in clean_text

Unsoundness in dashmap references

lmdb is unmaintained, use lmdb-rkv instead

Threshold value is ignored (all shares are n=3)

rental is unmaintained, author has moved on

cargo-download is unmaintained

Integer overflow in the bundled Brotli C library

Use after free in lru crate

Integer overflow in the bundled Brotli C library

Invalid handling of X509_verify_cert() internal errors in libssl

Incorrect Lifetime Bounds on Closures in rusqlite

serde_cbor is unmaintained

RustEmbed generated get method allows for directory traversal when reading files from disk

Panic on incorrect date input to simple_asn1

Data race when sending and receiving after closing a oneshot channel

Converting NSString to a String Truncates at Null Bytes

Generated code can read and write out of bounds in safe code

Potential segfault in localtime_r invocations

Non-aligned u32 read in Chacha20 encryption and decryption

abomonation transmutes &T to and from &[u8] without sufficient constraints

slice-deque is unmaintained

Out-of-bounds write in nix::unistd::getgrouplist

FixedSizeBinaryArray does not perform bound checks on accessing values and offsets

BinaryArray does not perform bound checks on reading values and offsets

DecimalArray does not perform bound checks on accessing values and offsets

#[zeroize(drop)] doesn't implement Drop for enums

Aliased mutable references from tls_rand & TlsWyRand

AtomicBucket unconditionally implements Send/Sync

Read on uninitialized buffer may cause UB ('tectonic_xdv' crate)

Memory Safety Issue when using patch or merge on state and assign the result back to state

Multiple Vulnerabilities in Wasmtime

Remote memory exhaustion in ckb

Process crashes when the cell used as DepGroup is not alive

Miner fails to get block template when a cell used as a cell dep has been destroyed.

Improper Synchronization and Race Condition in vm-memory

Permissions bypass in pleaser

Permissions bypass in pleaser

File exposure in pleaser

Relative Path Traversal in git-delta

Partial read is incorrect in molecule

Observable Discrepancy in libsecp256k1-rs

Miscomputed results when using AVX2 backend

Uncontrolled Search Path Element in sharkdp/bat

Crate has been renamed to cosmrs

SM2 Decryption Buffer Overflow

Read buffer overruns processing ASN.1 strings

spirv_headers is unmaintained, use spirv instead

vec-const attempts to construct a Vec from a pointer to a const slice

read on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)

Read on uninitialized buffer in fill_buf() and read_up_to()

Read on uninitialized memory may cause UB (fn preamble_skipcount())

Data race in crossbeam-deque

Read on uninitialized buffer can cause UB (impl of ReadKVExt)

'Read' on uninitialized memory may cause UB

Reading on uninitialized memory may cause UB ( util::read_spv() )

Deserialization functions pass uninitialized memory to user-provided Read

Optional Deserialize implementations lacking validation

InputStream::read_exact : Read on uninitialized buffer causes UB

Window can read out of bounds if Read instance returns more bytes than buffer size

Read on uninitialized buffer may cause UB ( read_entry() )

columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())

mopa is technically unsound

QueryInterface should call AddRef before returning pointer

Reading on uninitialized buffer may cause UB ( gfx_auxil::read_spirv() )

Potential request smuggling capabilities due to lack of input validation

Links in archive can create arbitrary directories

Integer overflow in hyper's parsing of the Transfer-Encoding header leads to data loss

Lenient hyper header parsing of Content-Length could allow request smuggling

Improper Input Validation of octal literals in std::net

better-macro has deliberate RCE to prove a point

libsecp256k1 allows overflowing signatures

Flaw in FieldVar::mul_by_inverse allows unsound R1CS constraint systems

Incorrect handling of embedded SVG and MathML leads to mutation XSS

Conversion from prost_types::Timestamp to SystemTime can cause an overflow and panic

Task dropped in wrong thread when aborting LocalSet task

MutexGuard<Cell<i32>> must not be Sync

API soundness issue in join() implementation of [Borrow<str>]

vec_deque::Iter has unsound Debug implementation

Double free in Vec::from_iter specialization when drop panics

Insufficient synchronization in Arc::get_mut

grep-cli may run arbitrary executables on Windows

VecStorage Deserialize Allows Violation of Length Invariant

SMTP command injection in body

Soundness issue in iced-x86 versions <= 1.10.3

Memory access due to code generation flaw in Cranelift module

Denial of service on EVM execution due to memory over-allocation

anymap is unmaintained.

cpuid-bool has been renamed to cpufeatures

XSS in comrak

aes-soft has been merged into the aes crate

project abandoned; migrate to the aes-siv crate

aes-ctr has been merged into the aes crate

aesni has been merged into the aes crate

NULL pointer deref in signature_algorithms processing

Integer overflow in CipherUpdate

CA certificate check bypass with X509_V_FLAG_X509_STRICT

Null pointer deref in X509_issuer_and_serial_hash()

Archives may contain uninitialized memory

'merge_sort::merge()' crashes with double-free for T: Drop

Zip can cause buffer overflow when a consumed Zip iterator is used again

String::retain allows safely creating invalid strings when abusing panic

Logic bug in Read can cause buffer overflow in read_to_end()

Panic safety violation in BinaryHeap

Zip may call __iterator_get_unchecked twice with the same index

VecDeque::make_contiguous may duplicate the contained elements

Panic safety issue in Zip specialization

TrustedRandomAccess specialization composes incorrectly for nested iter::Zips

Multiple functions can cause double-frees

KeyValueReader passes uninitialized memory to Read instance

swap_index can write out of bounds and return uninitialized memory

RingBuffer can create multiple mutable references and cause data races

SliceDeque::drain_filter can double drop an element if the predicate panics

Data race and memory safety issue in Index

StackVec::extend can write out of bounds when size_hint is incorrect

Generators can cause data races if non-Send types are used in their generator functions

through and through_and causes a double free if the map function panics

ImmediateIO and TransactionalIO can cause data races

FromIterator implementation for Vector/Matrix can drop uninitialized memory

PartialReader passes uninitialized memory to user-provided Read

Multiple soundness issues in Ptr

Use after free possible in uri::Formatter on panic

insert_many can drop elements twice on panic

Denial of service through parsing payloads with too big exponent

panic in user-provided Endian impl triggers double drop of T

panic safety: double drop or uninitialized drop of T upon panic

Multiple memory safety issues

Fix a use-after-free bug in diesels Sqlite backend

quinn invalidly assumes the memory layout of std::net::SocketAddr

rulinalg is unmaintained, use nalgebra instead

Intern: Data race allowed on T

office is unmaintained, use calamine instead

push_cloned can drop uninitialized memory or double free on panic

split_at allows obtaining multiple mutable references to the same data

move_elements can double-free objects on panic

Deserializing an array can drop uninitialized memory on panic

arr! macro erases lifetimes

Loading a bgzip block can write out of bounds if size overflows.

Tape::take_bytes exposes uninitialized memory to a user-provided Read

Multiple memory safety issues in insert_row

Use-after-free when cloning a partially consumed Vec iterator

XSS in comrak

crate has been renamed to qjsonrpc

crate has been renamed to sn_api

Incorrect check on buffer length when seeding RNGs

Use-after-free in subscript_next and subscript_prev wrappers

nb-connect invalidly assumes the memory layout of std::net::SocketAddr

lzw is unmaintained

Multiple Transfer-Encoding headers misinterprets request payload

insert_slice_clone can double drop if Clone panics.

Multiple soundness issues

Queues allow non-Send types to be sent to other threads, allowing data races

Send bound needed on T (for Send impl of Bucket2)

MvccRwLock allows data races & aliasing violations

IoReader::read(): user-provided Read on uninitialized buffer may cause UB

Read on uninitialized buffer may cause UB (impl Walue for Vec<u8>)

Bunch unconditionally implements Send/Sync

Sectors::get accesses unclaimed/uninitialized memory

FixedCapacityDequeLike::clone() can cause dropping uninitialized memory

Queue should have a Send bound on its Send/Sync traits

convec::ConVec unconditionally implements Send/Sync

Shared can cause a data race

dces' World type can cause data races

LockWeak<T> allows to create data race to T.

AtomicBox lacks bound on its Send and Sync traits allowing data races

Slock allows sending non-Send types across thread boundaries

ShmWriter allows sending non-Send type across threads

ArcGuard's Send and Sync should have bounds on RC

SyncRef's clone() and debug() allow data races

SyncChannel can move 'T: !Send' to other threads

CopyCell lacks bounds on its Send trait allowing for data races

Send/Sync bound needed on T for Send/Sync impl of RcuCell

Cache: Send/Sync impls needs trait bounds on K

ReaderResult should be bounded by Sync

Contents of uninitialized memory exposed in DeflateOutput's AsyncRead implementation

Record::read : Custom Read on uninitialized buffer may cause UB

beef::Cow lacks a Sync bound on its Send trait allowing for data races

ReadTicket and WriteTicket should only be sendable when T is Send

AtomicBox implements Send/Sync for any T: Sized

Decoder<R> can carry R: !Send to other threads

Future lacks bounds on Send and Sync.

QueueSender/QueueReceiver: Send/Sync impls need T: Send

PinSlab and Unordered<T, S> need bounds on their Send/Sync traits

Soundness issues in raw-cpuid

Reading uninitialized memory can cause UB (Deserializer::read_vec)

Singleton lacks bounds on Send and Sync.

Demuxer can carry non-Send types across thread boundaries

hashconsing's HConsed lacks Send/Sync bound for its Send/Sync trait.

stderr is unmaintained; use eprintln instead

may_queue's Queue lacks Send/Sync bound for its Send/Sync trait.

Update unsound DrainFilter and RString::retain

ButtplugFutureStateShared allows data race to (!Send|!Sync) objects

Soundness issue: Input can be misused to create data race to an object

Queues allow non-Send types to be sent to other threads, allowing data races

AtomicOption should have Send + Sync bound on its type argument.

panic safety: double drop may happen within util::{mutate, mutate2}

reading on uninitialized buffer can cause UB (impl<R> BufRead for GreedyAccessReader<R>)

panic safety issue in impl TransformContent<S, D> for [S; (2|3|4)]

LateStatic has incorrect Sync bound

conquer-once's OnceCell lacks Send bound for its Sync trait.

ImageChunkMut needs bounds on its Send and Sync traits

EventList's From conversions can double drop on panic.

impl Random on arrays can lead to dropping uninitialized memory

Double free when calling sys_info::disk_info from multiple threads

Frame::copy_from_raw_parts can lead to segfault without unsafe

Aovec lacks bound on its Send and Sync traits allowing data races

Exposes internally used raw pointer

Missing Send bound for Lazy

TreeFocus lacks bounds on its Send and Sync traits

Soundness issue with base::Error

UsbContext trait did not require implementers to be Send and Sync.