RustSec Advisories

RUSTSEC-2026-0351: Vulnerability in wasmtime-wasi-http

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0351

wasi-http: Request with long url before query parameter crashes host

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime-wasi-http (crates.io)

Type

Vulnerability

Aliases

GHSA-w36r-2hch-9xp9

References

https://github.com/bytecodealliance/wasmtime/pull/14728

CVSS Score

5.3 MEDIUM

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-w36r-2hch-9xp9 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0350: Vulnerability in wasmtime-wasi-http

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0350

Guests can send absolute-form HTTP requests to different hosts

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime-wasi-http (crates.io)

Type

Vulnerability

Aliases

GHSA-5qpp-g3j2-8frx

References

https://github.com/bytecodealliance/wasmtime/pull/14727

CVSS Score

2.1 LOW

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: None
Confidentiality Impact to the Vulnerable System: Low
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Patched

>=36.0.18, <37.0.0
>=48.0.6, <49.0.0
>=49.0.3

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5qpp-g3j2-8frx For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0352: Vulnerability in wasmtime-wasi

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0352

Filesystem sandbox escape when renaming symlinks with trailing slashes

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime-wasi (crates.io)

Type

Vulnerability

Aliases

GHSA-m9f7-9w4p-gv38

References

https://github.com/bytecodealliance/wasmtime/pull/14729

CVSS Score

8.8 HIGH

CVSS Details

Attack Complexity: Low
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: Low
Confidentiality Impact to the Subsequent System: High
Integrity Impact to the Subsequent System: High
User Interaction: Passive
Availability Impact to the Vulnerable System: Low
Confidentiality Impact to the Vulnerable System: High
Integrity Impact to the Vulnerable System: High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Patched

>=36.0.18, <37.0.0
>=48.0.6, <49.0.0
>=49.0.3

Affected OSes

macos
freebsd

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m9f7-9w4p-gv38 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0358: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0358

Yielding in a component start function can lead to a host panic

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-5hhx-4wrr-3j9g

References

https://github.com/bytecodealliance/wasmtime/pull/14620

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-5hhx-4wrr-3j9g For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0361: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0361

Panic when pending calls are run after a trap

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-hmwq-g22x-qjw5

References

https://github.com/bytecodealliance/wasmtime/pull/14736

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hmwq-g22x-qjw5 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0364: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0364

Exception tags can cause host data structures to be unaligned

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-p79w-pv2r-29qp

References

https://github.com/bytecodealliance/wasmtime/pull/14731

CVSS Score

2.1 LOW

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: None
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: Low

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<47.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-p79w-pv2r-29qp For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0362: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0362

Wasmtime may not properly enforce async-entrypoint requirement

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-vcg5-q8m5-8379

References

https://github.com/bytecodealliance/wasmtime/pull/14734

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<42.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vcg5-q8m5-8379 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0353: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0353

Panic when invoking an async-lifted function via call

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-m6w2-jwq2-cv2c

References

https://github.com/bytecodealliance/wasmtime/pull/14737

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-m6w2-jwq2-cv2c For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0359: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0359

Stack overflow dropping a long chain of recursive types

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-wjc8-633q-pwxr

References

https://github.com/bytecodealliance/wasmtime/pull/14735

CVSS Score

5.3 MEDIUM

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<42.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-wjc8-633q-pwxr For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0360: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0360

Overlapping string transcode in a fused adapter can panic

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-54p9-vhhq-8f7q

References

https://github.com/bytecodealliance/wasmtime/pull/14730

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: Low
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=49.0.3

Unaffected

<49.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-54p9-vhhq-8f7q For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0363: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0363

Component-model handle tables are capped only per instance and charged to no limit

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-q554-3cjc-rx7p

References

https://github.com/bytecodealliance/wasmtime/pull/14732

CVSS Score

6.2 MEDIUM

CVSS Details

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=36.0.18, <37.0.0
>=48.0.6, <49.0.0
>=49.0.3

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-q554-3cjc-rx7p For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0356: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0356

Panic on erroneous call-to-host from guest realloc call

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-7v24-42x9-pxf7

References

https://github.com/bytecodealliance/wasmtime/pull/14739

CVSS Score

5.3 MEDIUM

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-7v24-42x9-pxf7 For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0357: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0357

Out-of-bounds zero-length stream writes can panic

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-93g3-36p8-x2gc

References

https://github.com/bytecodealliance/wasmtime/pull/14740

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: Low
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-93g3-36p8-x2gc For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0355: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0355

Panic viewing component model stream or future as the wrong type

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-63h4-6cx9-pjfj

References

https://github.com/bytecodealliance/wasmtime/pull/14733

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-63h4-6cx9-pjfj For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0354: Vulnerability in wasmtime

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0354

Host panic when component call_async is cancelled under some conditions

Reported

October 14, 2026

Issued

October 14, 2026

Package

wasmtime (crates.io)

Type

Vulnerability

Aliases

GHSA-3r89-v5mq-j5xf

References

https://github.com/bytecodealliance/wasmtime/pull/14741

CVSS Score

5.9 MEDIUM

CVSS Details

Attack Complexity: High
Attack Requirements: Present
Attack Vector: Network
Privileges Required: Low
Availability Impact to the Subsequent System: None
Confidentiality Impact to the Subsequent System: None
Integrity Impact to the Subsequent System: None
User Interaction: Passive
Availability Impact to the Vulnerable System: High
Confidentiality Impact to the Vulnerable System: None
Integrity Impact to the Vulnerable System: None

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Patched

>=48.0.6, <49.0.0
>=49.0.3

Unaffected

<46.0.0

Description

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3r89-v5mq-j5xf For more information see the GitHub-hosted security advisory.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0347: Vulnerability in rustls

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0347

Buffered application data sent to outer server after ECH rejection

Reported

October 14, 2026

Issued

October 14, 2026

Package

rustls (crates.io)

Type

Vulnerability

Categories

crypto-failure

Aliases

GHSA-vp88-798v-h67f

References

https://github.com/rustls/rustls/pull/3300

CVSS Score

2.3 LOW

CVSS Details

Attack Vector: Local
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Patched

>=0.23.46

Unaffected

<0.23.44

Description

When a server rejects Encrypted Client Hello (ECH), the client completes the handshake using the outer ClientHello and authenticates the server against the ECH config's public_name. At the end of that handshake, rustls encrypted and queued any application data buffered via ClientConnection::writer() before queueing the ech_required alert.

The application correctly receives Error::PeerIncompatible(ServerRejectedEncryptedClientHello), but the next write_tls() call (needed to send the alert) also sends the buffered application data. Plaintext meant for the inner server therefore goes to the client-facing server named by public_name.

That server is authenticated, so this is not exploitable by an unauthenticated party, but it violates RFC 9849 section 6.1.6, which requires the client to abort with ech_required "before sending any application data to the server".

This affects only clients that:

use EchMode::Enable (GREASE ECH is not affected),
write application data before the handshake completes, and
connect to a server that rejects their ECH config (for example, because it is stale).

The underlying ordering bug is older, but before 0.23.44 the client checked the server certificate against the inner server name rather than public_name, so certificate verification failed first and no data was sent.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0348: Vulnerability in rustls

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0348

Brotli certificate decompression can allocate up to 1 GiB before authentication

Reported

October 14, 2026

Issued

October 14, 2026

Package

rustls (crates.io)

Type

Vulnerability

Categories

denial-of-service

Aliases

GHSA-h2v8-394m-p7vv

References

https://github.com/rustls/rustls/pull/3297

CVSS Score

3.7 LOW

CVSS Details

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Patched

>=0.23.46

Unaffected

<0.23.9

Description

The built-in Brotli certificate decompressor (enabled by the non-default brotli crate feature) bounded the size of the decompressed output, but accepted a peer-selected history window. Brotli's large-window extension was enabled, so a five-byte header could cause an allocation of 1 GiB. A peer can abort a process whose allocator cannot satisfy that request.

No trusted certificate is required by the attacker. Affected configurations are:

clients that enable the brotli feature and connect to a malicious server, and
servers that enable the brotli feature and request client certificates.

Applications that do not enable the brotli feature are not affected.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0349: Vulnerability in rustls

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0349

Unauthenticated ServerHello can downgrade later connections to classical key exchange

Reported

October 14, 2026

Issued

October 14, 2026

Package

rustls (crates.io)

Type

Vulnerability

Categories

crypto-failure

Aliases

GHSA-w44r-93j7-qv28

References

https://github.com/rustls/rustls/pull/3355

CVSS Score

3.7 LOW

CVSS Details

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Patched

>=0.23.46

Description

The client recorded the server-selected key exchange group for each server name when processing the ServerHello, before the server was authenticated. This record is used to predict which key share to send in future ClientHellos to that server name.

A network attacker can answer one connection attempt with a ServerHello selecting X25519, and then close the connection. Later ClientHellos for that name carry only an X25519 key share, while supported_groups still lists X25519MLKEM768 first. If the genuine server accepts that share rather than sending a HelloRetryRequest for its preferred hybrid group, the handshake completes with classical-only key exchange and no error. This persists for as long as the entry stays in the client's session store.

The impact is loss of post-quantum confidentiality for affected connections ("harvest now, decrypt later"). There is no key compromise and no authentication bypass.

The following are not affected:

connections to servers which send a HelloRetryRequest for their preferred group,
clients with resumption disabled (as nothing is stored), and
other server names.

This behaviour is discussed in draft-ietf-tls-key-share-prediction, so the practical impact depends largely on server policy.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0346: Vulnerability in rustls

2026-10-14T12:00:00+00:00

RUSTSEC-2026-0346

Debug impls for client session values expose TLS secrets

Reported

October 14, 2026

Issued

October 14, 2026

Package

rustls (crates.io)

Type

Vulnerability

Categories

crypto-failure

Aliases

GHSA-c8m5-c952-6cm4

References

https://github.com/rustls/rustls/pull/3299

CVSS Score

4 MEDIUM

CVSS Details

Attack Vector: Local
Attack Complexity: High
Privileges Required: High
User Interaction: Required
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Patched

>=0.23.46

Unaffected

<0.21.0

Description

The Debug implementations of Tls12ClientSessionValue and Tls13ClientSessionValue were derived, and so included the TLS 1.2 master secret or TLS 1.3 resumption PSK in their output.

Custom ClientSessionStore implementations that format these values with Debug (for example, when logging) could disclose these secrets to readers of the logs. This conflicts with rustls's key-material redaction policy.

Ordinary connection and built-in session cache Debug output is redacted and is not affected.

Advisory available under CC0-1.0 license.

RUSTSEC-2021-0158: Vulnerability in ammonia

2026-10-13T12:00:00+00:00

RUSTSEC-2021-0158

XSS in ammonia via SVG animateMotion, animateTransform, and/or animateColor tags

Reported

October 10, 2021

Issued

October 13, 2026

Package

ammonia (crates.io)

Type

Vulnerability

Categories

format-injection

Keywords

#html #xss

Aliases

GHSA-f2pc-rwv3-69mv

References

https://github.com/rust-ammonia/ammonia/pull/261

Patched

>=4.2.3
>=4.1.7, <4.2.0

Description

The neutralization that ammonia applied to animate and set was not applied to other forms of SVG animation, which can be used for XSS.

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

<svg xmlns="http://www.w3.org/2000/svg">
  <a>
    <animateMotion attributeName="href" to="javascript:alert('SET_XSS')"></animateMotion>
    <text y="30">Click set</text>
  </a>
</svg>

Ammonia did not apply attribute filters based on attributeName, so the contents of the to, from, and values tags were not sanitized as URLs.

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

This vulnerability was reported by ucsurf.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0345: Vulnerability in kuva

2026-10-13T12:00:00+00:00

RUSTSEC-2026-0345

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

Reported

August 7, 2026

Issued

October 13, 2026

Package

kuva (crates.io)

Type

Vulnerability

Categories

format-injection

Keywords

#svg #xss #injection #ansi #escaping

Aliases

GHSA-3c48-9r95-hqhr

References

Patched

>=0.3.1, <0.4.0
>=0.4.1

Unaffected

<0.1.5

Description

Affected versions of kuva wrote data-derived strings straight into rendered output without escaping them for the target format. Applications that plot untrusted input (column headers, category and group names, series labels) were affected in three places.

1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity was enabled via Layout::with_interactive, group and category labels were formatted directly into data-group and data-x attributes through the raw Primitive::GroupStart.extra_attrs string, which the SVG backend emitted verbatim. The backend's escaping helper covered text nodes and <title> but not attributes. A label containing a double quote could close the attribute and add another, for example an event handler. Opening the resulting SVG in a browser, or inlining it into an HTML page, executed the injected script. Reachable from scatter, line, bar, and strip plots, and from legends.

2. Unvalidated CSS and style attribute values (CWE-74). Color::Css wrote arbitrary strings into fill and stroke, stroke-dasharray was emitted raw from the public dash-pattern builders, and the SVG root font-family and fill plus the background rectangle fill were written raw from layout and theme configuration. Applications that forwarded user-supplied style values into the plotting API could have those values break out of the attribute they were written into.

3. Terminal escape sequence injection (CWE-150). TerminalBackend stored label characters unfiltered and emitted each one unconditionally when producing its ANSI string. Control characters in a label, including ESC, OSC sequences, and carriage returns, were written straight to the operator's terminal. Depending on the emulator this allows forged or misleading output, window title and clipboard manipulation, and reaching terminal emulator vulnerabilities that are triggered by escape sequences.

The fix routes every data-derived string through format-appropriate escaping. A single escape_attr helper XML-escapes &, <, >, ", and ', and is applied at each raw-attribute site: the extra_attrs interpolations, the Color::Css catch-all, and the SVG backend's stroke-dasharray, font-family, and background fill writes. TerminalBackend::set_char replaces control characters with U+FFFD before they enter the character grid, so one cell stays one column rather than the grid shifting, and the ANSI writer emits the grid unchanged.

Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked.

Users who cannot upgrade should sanitize labels before passing them to kuva, and avoid interactive SVG output for untrusted data.

Note that Scene::defs, Scene::scripts, and Primitive::GroupStart.extra_attrs remain raw escape hatches by design. They are documented as trusted-only and are not covered by this advisory; populating them from user data is equivalent to executing that data.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0344: Vulnerability in ruzstd

2026-10-13T12:00:00+00:00

RUSTSEC-2026-0344

Decompression bomb in ruzstd: a tiny input can exhaust memory (OOM)

Reported

October 11, 2026

Issued

October 13, 2026

Package

ruzstd (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#zstd #decompression-bomb #oom

References

https://github.com/KillingSpark/zstd-rs/commit/d3907c960ca4a1aa44cc38340137c5679dd98f5a

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.9.1

Description

A crafted .zst input under 128 KB can force ruzstd to allocate several gigabytes at once, crashing the process with an out-of-memory condition. Since ruzstd is a decoder for untrusted input, a single small file is enough to take down anything decoding it.

The compressed size of a block was capped at 128 KB, but a compressed block's decompressed size was never checked against Block_Maximum_Size = min(Window_Size, 128 KiB) (RFC 8878). In execute_sequences the output was built with no running bound and no flush between blocks, so one block could expand to gigabytes — bypassing both the configured window-size limit and the block-by-block streaming that would otherwise release memory. (A related u32 counter overflow on such a block caused an additional panic.)

This is a denial of service only; memory access stays in bounds (no corruption, no RCE).

ruzstd is also built as a dependency of the Rust standard library via rustc-dep-of-std; in the toolchain it is used only to load zstd-compressed debug symbols, so the toolchain-side impact is limited.

Fixed in 0.9.1 (commit d3907c9), which enforces the per-block output bound. Upgrade to ruzstd >= 0.9.1.

Advisory available under CC0-1.0 license.

RUSTSEC-2021-0157: Vulnerability in ammonia

2026-10-12T12:00:00+00:00

RUSTSEC-2021-0157

Incorrect escaping for url("") functions in CSS style attributes

Reported

October 10, 2021

Issued

October 12, 2026

Package

ammonia (crates.io)

Type

Vulnerability

Categories

format-injection

Keywords

#html #clickjacking

Aliases

GHSA-69v2-w9vg-4g83

References

https://github.com/rust-ammonia/ammonia/pull/259

Patched

>=4.2.3
>=4.1.7, <4.2.0

Description

In some cases, quotation marks in CSS url() functions are not escaped. This allows CSS injection. This feature is not enabled by default, so an application is vulnerable if, and only if, the style attribute is allowed and filter_style_properties is used.

As an example, this snippet:

<div style='background:url("cid:\");EVIL_CSS_HERE;background:url(\"cid:")'>

Would erroneously "sanitize" to:

<div style='background:url("cid:");EVIL_CSS_HERE;background:url("cid:")'>

This vulnerability was reported by Uttej Badwane

Advisory available under CC0-1.0 license.

RUSTSEC-2024-0449: unsafe-libyaml is unmaintained

2026-10-12T12:00:00+00:00

RUSTSEC-2024-0449

unsafe-libyaml is unmaintained

Reported

March 25, 2024

Issued

October 12, 2026

Package

unsafe-libyaml (crates.io)

Type

INFO Unmaintained

References

https://github.com/dtolnay/unsafe-libyaml

Patched

no patched versions

Description

The repository was archived by its owner on 2024-03-25 and is read-only. The last release is 0.2.11 (March 2024).

unsafe-libyaml is a machine translation of libyaml's C code into unsafe Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by serde_yaml (itself deprecated) and by forks such as serde_yaml_ng.

Alternatives

Consider a YAML parser written in safe Rust, for example:

saphyr (serde-saphyr for serde users)
noyalib

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0337: Vulnerability in ic-cipher

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0337

Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more

Reported

October 9, 2026

Issued

October 12, 2026

Package

ic-cipher (crates.io)

Type

Vulnerability

Categories

Keywords

#poly1305 #chacha20-poly1305 #integer-overflow

Aliases

GHSA-xr22-8pqp-gwfh

References

https://github.com/nervosys/IronCrypto/commit/a8160a18b5c66288f05dc62f5ea2159c687b9416

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.2.20

Unaffected

<0.2.5

Description

Poly1305 in ic-cipher absorbs messages of 64 bytes or more four blocks at a time, summing four products before one reduction. From 0.2.5 to 0.2.19 the reduction kept its carries in 32-bit integers, which four summed products can overflow when the message's bytes are large.

This affects Poly1305 and ChaCha20Poly1305, and everything built on them: the TLS and QUIC ChaCha20-Poly1305 suites in ic-rustls, HPKE with that cipher in ic-hpke, and the re-exports in ic-mac and ironcrypto.

What happens depends on how the crate was compiled:

With overflow checks on (any debug build, or a release profile with overflow-checks = true) the multiplication panics, and under panic = "abort" the process ends. The tag is computed over the ciphertext before it is compared, so this happens before authentication and without the key: anyone who can deliver a ChaCha20-Poly1305 ciphertext to be opened can trigger it.
With overflow checks off (Cargo's default for release builds) the arithmetic wraps and the tag is computed wrong on the affected messages.

Ordinary data does not reach the defect. A message of 0xff bytes does: in one measurement against 0.2.19, 28 of 500 ChaCha20Poly1305::open_detached calls on 1,024 bytes of 0xff under random keys and nonces panicked in a debug build. ChaCha20-Poly1305 derives a new Poly1305 key for every nonce, so each message is a fresh attempt.

AES-GCM and AES-GCM-SIV are not affected, and neither are messages shorter than 64 bytes.

The flaw was corrected in 0.2.20 by carrying in 64 bits.

It was found by running Project Wycheproof's ChaCha20-Poly1305 test vectors against the library.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0341: Vulnerability in quinn-proto

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0341

Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

Reported

August 17, 2026

Issued

October 12, 2026

Package

quinn-proto (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#oom

Aliases

GHSA-qfwj-vfxf-92j2

References

https://github.com/quinn-rs/quinn/pull/2790

Related

RUSTSEC-2026-0185

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.11.17

Unaffected

<0.11.15

Description

The fix for RUSTSEC-2026-0185 in 0.11.15 added a cap on the number of chunks buffered by the Assembler that reassembles out-of-order stream data. However, the cap was only checked inside the branch that triggers defragmentation, which only runs when the estimated over-allocation exceeds a threshold proportional to the amount of buffered data. Frames handled entirely by the unordered-read deduplication loop returned before the check ran at all.

A peer sending one small gapped STREAM frame per packet (for example, 6-byte frames separated by 1-byte gaps) keeps the per-chunk overhead below the defragmentation threshold, so the cap is never evaluated and the chunk count grows until stream-level flow control stops the peer. With the default TransportConfig (100 concurrent unidirectional streams and a 1.25 MB stream receive window), a remote, unauthenticated peer can pin roughly 3 GB of receiver memory using about 125 MB of accounted stream data. The memory is not reclaimed until the affected streams or the connection are closed.

The flaw was corrected in 0.11.17 by checking the chunk count after every insert (including in the unordered deduplication loop) and compacting the buffer once it passes a watermark above the cap. A stream is rejected once compaction can no longer bring the chunk count back under the cap.

Versions before 0.11.15 are affected by the original, broader issue described in RUSTSEC-2026-0185.

Thanks to Otto Hermann (@ojhermann) for reporting and fixing this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0343: Vulnerability in quinn-proto

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0343

Outgoing datagram buffer accounting can panic the sender in quinn-proto

Reported

September 14, 2026

Issued

October 12, 2026

Package

quinn-proto (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#panic

Aliases

GHSA-ppcp-v39w-8jq2

References

https://github.com/quinn-rs/quinn/pull/2806

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.11.18

Unaffected

<0.11.17

Description

The limit on memory used to buffer outgoing datagrams, introduced in 0.11.17, subtracted an evicted datagram's size from the buffered byte counter twice when Datagrams::send was called with drop = true (as Connection::send_datagram in the quinn crate does) while the buffer was full. Under sustained eviction the counter drifts below its true value: debug builds panic with an integer underflow, while release builds wrap the counter, drain the whole queue, and then panic on a desynchronization check in a later send call. In quinn, this panic occurs while the connection lock is held, poisoning it and causing a double panic (and thus an abort) when the connection is dropped.

This can be triggered without a malicious peer, by an application that sends a burst of datagrams and then idles. It can also be triggered by a peer that keeps the connection alive with PING frames while withholding acknowledgements, so that the sender's congestion window stays closed and the outgoing queue never drains. Applications that use send_datagram_wait are not affected.

Only 0.11.17 is affected; the flaw was corrected in 0.11.18 by removing the redundant subtraction.

Thanks to @alexpyattaev for reporting and @vcarus for fixing this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0339: Vulnerability in quinn-proto

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0339

Unbounded growth of pending connection ID retirements in quinn-proto

Reported

August 17, 2026

Issued

October 12, 2026

Package

quinn-proto (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#oom

Aliases

GHSA-hmxj-32vh-65vr

References

https://github.com/quinn-rs/quinn/pull/2790

Patched

>=0.11.17

Unaffected

<0.6.0

Description

When processing a NEW_CONNECTION_ID frame, quinn-proto queues a RETIRE_CONNECTION_ID frame for each connection ID that the peer asked it to retire. The normal path bounds this queue and closes the connection with a CONNECTION_ID_LIMIT_ERROR if the bound would be exceeded. However, the path handling a connection ID that had already been retired pushed onto the queue without applying the limit and without deduplicating.

A peer that has completed the handshake can first send a NEW_CONNECTION_ID frame with a large retire_prior_to value to advance the receiver's connection ID window, and then repeatedly send NEW_CONNECTION_ID frames with sequence numbers below that window. Each such frame adds another entry to the queue. The queue is only drained by sending RETIRE_CONNECTION_ID frames, which are subject to congestion control, so a peer that withholds acknowledgements can stall the drain while continuing to flood, growing the victim's memory use without bound.

The flaw was corrected in 0.11.17 by applying the same limit on the already-retired path.

Thanks to @scadastrangelove for reporting this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0342: Vulnerability in quinn-proto

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0342

Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto

Reported

August 17, 2026

Issued

October 12, 2026

Package

quinn-proto (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#oom

Aliases

GHSA-2hv7-gw8g-gpq5

References

https://github.com/quinn-rs/quinn/pull/2790

Patched

>=0.11.17

Unaffected

<0.5.0

Description

quinn-proto bounds its queue of received datagrams by charging each queued frame's payload length against TransportConfig::datagram_receive_buffer_size, evicting the oldest datagrams when the limit is exceeded. A DATAGRAM frame with an empty payload was charged zero bytes, so it never triggered eviction and was appended to the queue, which has no other bound.

DATAGRAM frames are not subject to flow control. A peer that has completed the handshake can therefore send a stream of empty DATAGRAM frames and grow the receiver's heap without limit until the process is killed. An application that reads incoming datagrams but does so more slowly than the peer sends them is still affected. Receiving datagrams is enabled by default, so all endpoints that do not explicitly set datagram_receive_buffer_size(None) are affected.

The send path had the same accounting flaw: an application could enqueue an unbounded number of empty outgoing datagrams without ever receiving SendDatagramError::Blocked.

The flaw was corrected in 0.11.17 by accounting for the fixed per-datagram overhead in both directions, so that every queued datagram consumes buffer space.

Thanks to @alexpyattaev for reporting this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0340: Vulnerability in quinn-proto

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0340

Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled

Reported

September 14, 2026

Issued

October 12, 2026

Package

quinn-proto (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#panic

Aliases

GHSA-3g6h-r5qx-f6hq

References

https://github.com/quinn-rs/quinn/pull/2868

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.11.18

Unaffected

<0.11.0

Description

When sending ACK_FREQUENCY frames is enabled through TransportConfig::ack_frequency_config(Some(..)), the peer's transport parameters could cause AckFrequencyState::candidate_max_ack_delay to call Duration::clamp with a minimum greater than its maximum, which panics.

For example, a peer advertising a min_ack_delay of 100,000 microseconds and a max_ack_delay of 100 milliseconds passes transport parameter validation. At a 5 ms RTT, the lower bound of the clamp becomes 100 ms while the upper bound is 25 ms, violating the precondition of clamp and panicking while driving the connection. Both automatically derived and explicitly configured maximum ACK delays use this calculation.

Sending ACK_FREQUENCY frames is disabled by default, so only endpoints that opt in are affected.

The flaw was corrected in 0.11.18 by computing the delay with explicit minimum and maximum bounds instead of clamp.

Thanks to @zerox80 for reporting this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0338: Vulnerability in quinn-proto

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0338

Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

Reported

September 14, 2026

Issued

October 12, 2026

Package

quinn-proto (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#panic

Aliases

GHSA-465w-v9q3-7j98

References

https://github.com/quinn-rs/quinn/pull/2868

Patched

>=0.11.18

Unaffected

<0.7.0

Description

When a stream is read in unordered mode (for example through RecvStream::read(false) in quinn-proto or read_unordered in quinn), quinn-proto proactively deduplicates received data by recording received ranges in a RangeSet through its replace method. When an incoming STREAM frame carried an empty payload, the Drop implementation of the iterator returned by replace inserted an empty range into the set, violating the invariant that stored ranges are non-empty. Subsequent frames overlapping that region then caused a panic while processing the stream.

A remote peer can trigger this with five small STREAM frames (two of them zero-length) once the application has put the stream in unordered-read mode. The default ordered read path is not affected.

The flaw was corrected in 0.11.18 by ignoring empty ranges in RangeSet::replace.

Thanks to Otto Hermann (@ojhermann) for reporting this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0335: Vulnerability in mykey

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0335

Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key

Reported

October 9, 2026

Issued

October 12, 2026

Package

mykey (crates.io)

Type

Vulnerability

Categories

crypto-failure

Keywords

#mikey #srtp #rfc3830 #key-disclosure

Aliases

GHSA-fwjg-cm92-j3hj

References

https://github.com/waxspin/mykey/pull/25

CVSS Score

9.1 CRITICAL

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Patched

>=2.0.0

Description

mykey implements MIKEY (RFC 3830) for SRTP key exchange. Pre-shared key mode transmitted the TEK Generation Key (TGK) in the clear.

MikeyMessage::new_psk_init built its KEMAC payload with EncAlg::Null and placed the TGK in enc_data verbatim. Anyone able to read a PSK-Init message therefore recovers the TGK — and so the SRTP master key — without knowing the pre-shared key.

The transmitted value was never even used by the receiver: complete_psk re-derived the TGK from the pre-shared key and ignored enc_data entirely. The field was write-only; it provided nothing and disclosed everything.

A second consequence: the message authentication key was derived from the TGK rather than from the pre-shared key, so an attacker who read the TGK off the wire could also forge a valid message MAC. Integrity was lost along with confidentiality. That aspect is tracked separately as GHSA-xq78-wvcv-hqvj.

Exploitability

A MIKEY message is normally distributed as an SDP a=key-mgmt:mikey attribute, which in AES67 and SMPTE ST 2110 deployments is typically announced over SAP multicast. A passive listener on the media network recovers the session key with no active attack and no credentials.

RFC 3830 §4.2.3 permits NULL encryption only where "the underlying protocols can guarantee security", and warns to use it with caution. An SDP file or a SAP announcement is not such a channel.

The fix

Pre-shared key mode now follows RFC 3830 §3.1 as key transport: the initiator generates a random TGK, frames it as a Key data sub-payload (§6.13), and encrypts it with AES-CM (§4.2.3) under an encryption key and 112-bit salt derived from the pre-shared key (§4.1.4). The message MAC is keyed from the pre-shared key and verified before anything is decrypted.

This changes the wire format, so both ends of an exchange must be upgraded together. The incompatibility is silent: an old peer and a new peer complete the exchange without error and then derive different SRTP keys.

Workarounds

Use ephemeral Diffie-Hellman mode instead of pre-shared key mode, or carry the PSK-Init only over a channel that is already confidential and authenticated end to end.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0336: Vulnerability in mykey

2026-10-12T12:00:00+00:00

RUSTSEC-2026-0336

MIKEY message MAC is never verified on receive, so forged messages are accepted

Reported

October 9, 2026

Issued

October 12, 2026

Package

mykey (crates.io)

Type

Vulnerability

Categories

crypto-failure

Keywords

#mikey #srtp #rfc3830 #authentication-bypass

Aliases

GHSA-xq78-wvcv-hqvj

References

https://github.com/waxspin/mykey/pull/25

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Patched

>=2.0.0

Description

mykey implements MIKEY (RFC 3830) for SRTP key exchange. No receive path verified the MIKEY message authentication code.

crypto::verify_mac existed and was correct, but it was called only from unit tests — neither MikeyMessage::from_bytes nor MikeyMessage::complete_psk invoked it.

new_psk_init computed an HMAC-SHA-1-160 over the serialized message and appended it, so the tag was present on the wire and looked like integrity protection. It was decorative: a receiver accepted any message regardless of whether the MAC was correct, wrong, or absent.

Consequences

An attacker able to inject or modify MIKEY messages in transit faced no integrity check. Modified RAND, SSRC or security-policy payloads were accepted silently. Note that this does not require a man-in-the-middle position: since nothing was checked, a wholly forged PSK-Init was accepted.
Pre-shared key mode therefore provided no mutual authentication, despite the documentation claiming that it did. Possession of the pre-shared key was never actually proven by either party.
Replayed init messages were not rejected.

The practical severity was bounded by GHSA-fwjg-cm92-j3hj (cleartext TGK), which already let a passive observer recover the key material outright without needing to forge anything.

The fix

complete_psk now verifies the message MAC before any decryption, so a message that fails authentication yields no key material at all. A MacAlg::Null payload, an absent MAC and a truncated MAC are each refused rather than treated as "no check required".

The authentication key is now derived from the pre-shared key per RFC 3830 §4.1.4 rather than from the TGK — a prerequisite, since verifying against a TGK-derived key would have been circular while the TGK travelled in the message itself. Optional §6.9 verification messages were also added, giving the exchange genuine mutual authentication.

Replay protection is still absent: a captured PSK-Init can be replayed and will be accepted, because the optional COUNTER timestamp is emitted rather than a mandatory NTP type and no record of seen timestamps or RAND values is kept. That gap is tracked at https://github.com/waxspin/mykey/issues/24 and is not covered by this advisory.

Workarounds

Treat parsed MIKEY messages as unauthenticated input: do not rely on pre-shared key mode for peer authentication or message integrity, and carry it over a transport that provides both.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0334: Vulnerability in bip322

2026-10-09T12:00:00+00:00

RUSTSEC-2026-0334

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

Reported

August 14, 2026

Issued

October 9, 2026

Package

bip322 (crates.io)

Type

Vulnerability

Categories

crypto-failure

Keywords

#bip322 #bitcoin #signature-verification

Aliases

GHSA-5chw-87w3-j9cv

References

https://github.com/rust-bitcoin/bip322/commit/e8accbe7d39f48f030e44f333b4796e28f6aad80

CVSS Score

9.1 CRITICAL

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Patched

>=0.0.11

Unaffected

<0.0.6

Affected Functions

Version

bip322::verify_full

>=0.0.6, <0.0.11

bip322::verify_full_encoded

>=0.0.6, <0.0.11

bip322::verify_simple

>=0.0.6, <0.0.11

bip322::verify_simple_encoded

>=0.0.6, <0.0.11

Description

Affected versions of bip322 accepted a BIP-322 proof created with an attacker-controlled private key as a valid signature for an unrelated victim P2WPKH or P2SH-P2WPKH address, allowing complete authentication bypass in applications using verify_simple, verify_simple_encoded, verify_full, or verify_full_encoded as proof that a user controls a Bitcoin address.

In verify_full, the verifier obtained the public key from the caller-controlled witness and passed it to verify_full_p2wpkh, where the supposed public-key mismatch check read the key from the same witness and compared it with itself:

let witness_pub_key = &witness.to_vec()[1];

if &pub_key.to_bytes() != witness_pub_key {
    return Err(Error::PublicKeyMismatch);
}

Since pub_key was originally parsed from that exact witness element, this comparison was tautological. The code verified that the signature was valid for the public key embedded in the witness, but never verified that this public key hashes to the claimed address, violating BIP-322's requirement that the message_signature satisfy the message_challenge (the claimed address's scriptPubKey).

As a result, an attacker could select any victim P2WPKH or P2SH-P2WPKH address, construct the BIP-322 challenge for that address and message, sign it with their own unrelated private key, and have the proof accepted. No victim key or victim interaction was required. Application-level nonces do not mitigate this, since the attacker can construct and sign the current challenge message with their own key.

P2TR verification is not affected: the public key is derived from the address's witness program rather than from the caller-controlled witness.

The flaw was corrected in commit e8accbe by deriving the expected scriptPubKey from the witness public key (P2WPKH(HASH160(pubkey)), wrapped in P2SH for the nested case) and requiring it to exactly equal the scriptPubKey of the claimed address before signature verification, failing with Error::PublicKeyMismatch otherwise. The fix is included in version 0.0.11. Affected versions 0.0.6 through 0.0.10 have been yanked from crates.io.

There is no known workaround that mitigates the vulnerability. Upgrading to version 0.0.11 is the recommended course of action.

Advisory available under CC0-1.0 license.