RustSec Advisories

RUSTSEC-2026-0206: rustybuzz is unmaintained

2026-07-12T12:00:00+00:00

RUSTSEC-2026-0206

rustybuzz is unmaintained

Reported

July 11, 2026

Issued

July 12, 2026

Package

rustybuzz (crates.io)

Type

INFO Unmaintained

References

https://github.com/harfbuzz/rustybuzz/issues/166

Patched

no patched versions

Description

The current maintainer of rustybuzz has stated that the crate is unmaintained and will not receive further fixes or updates (see the referenced issue).

Alternative(s)

harfrust, an actively maintained and updated alternative which is part of the Harfbuzz project.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0205: Unsoundness in scc

2026-07-07T12:00:00+00:00

RUSTSEC-2026-0205

Array::insert violates exception safety if compare function panics, leading to potential Double-Free

Reported

July 6, 2026

Issued

July 7, 2026

Package

scc (crates.io)

Type

INFO Unsound

Keywords

#exception #unwind

References

https://codeberg.org/wvwwvwwv/scalable-concurrent-containers/issues/232

Patched

>=3.8.4

Description

In affected versions of this crate, Array::insert is not exception safe. In the UPSERT path, key and value's snapshot is written to self.data_block, and after the insertion is completed, key and value are mem::forget in order to prevent double free. However, during the insertion, K::compare is invoked, which is a user-provided method. If user deliberately call panic in this function, during unwinding, the destructors of key, value, and self will all be called (since the mem::forget has not been called yet), leading to Double Free. Similar issues happens in the !UPSERT path.

The soundness issue was fixed in version 3.8.4 by using ManuallyDrop instead of mem::forget, and separating fallible code from infallible code during a node split - insert = insert_try -> insert_unchecked.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0204: Vulnerability in crossbeam-epoch

2026-07-06T12:00:00+00:00

RUSTSEC-2026-0204

Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid

Reported

July 6, 2026

Issued

July 6, 2026

Package

crossbeam-epoch (crates.io)

Type

Vulnerability

Keywords

#NULL-pointer-dereference

References

https://github.com/crossbeam-rs/crossbeam/pull/1276

Patched

>=0.9.20

Unaffected

<0.9.0

Description

Affected versions of fmt::Display dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with Atomic::null or Shared::null. fmt::Debug impls and pre-0.9 fmt::Display impls, which do not dereference pointers, are not affected by this issue.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0203: tree-sitter-perl-next is unmaintained

2026-07-06T12:00:00+00:00

RUSTSEC-2026-0203

tree-sitter-perl-next is unmaintained

Reported

July 6, 2026

Issued

July 6, 2026

Package

tree-sitter-perl-next (crates.io)

Type

INFO Unmaintained

References

https://github.com/PRRPCHT/tree-sitter-perl-next

Patched

no patched versions

Description

The author of tree-sitter-perl-next has stated that the crate is unmaintained and will not receive further fixes (see the repo's readme).

Alternative(s)

ts-parser-perl , an actively maintained tree-sitter Perl grammar that tree-sitter-perl-next initially forked.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0202: Unsoundness in cxx

2026-07-05T12:00:00+00:00

RUSTSEC-2026-0202

let_cxx_string! uses uninitialized value due to exception safety violations

Reported

July 5, 2026

Issued

July 5, 2026

Package

cxx (crates.io)

Type

INFO Unsound

Categories

memory-exposure

Keywords

#exception #unwind

References

https://github.com/dtolnay/cxx/issues/1729

Patched

>=1.0.195

Affected Functions

Version

cxx::let_cxx_string

<1.0.195

Description

In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.

The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0199: Vulnerability in bcrypt

2026-07-04T12:00:00+00:00

RUSTSEC-2026-0199

Panic in bcrypt::verify on non-ASCII hash input

Reported

June 20, 2026

Issued

July 4, 2026

Package

bcrypt (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#panic #utf-8 #denial-of-service

References

CVSS Score

5.3 MEDIUM

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: Low

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Patched

>=0.19.2

Unaffected

<0.19.0

Description

bcrypt::verify(password, hash) and HashParts::from_str(hash) panic in str::slice_error_fail when given a 60-byte &str containing a multi-byte UTF-8 character at certain byte positions.

Impact

Any Rust code that calls bcrypt::verify (or HashParts::from_str) with an attacker-controlled hash string will panic. The bcrypt crate is #![forbid(unsafe_code)], so this is limited to a denial-of-service and cannot lead to memory corruption.

Realistic attack contexts include:

Rust authentication services reading hashes from a database that was previously compromised via, e.g., SQL injection. The attacker can then crash the service on every login attempt against the tampered account.
CLI tools accepting hashes from stdin or command-line arguments.
Password managers or vault services loading hashes from untrusted configuration sources.

Root cause

split_hash performed five &str slicing operations on the input hash: &hash[1..3], &hash[4..6], &hash[7..], &salt_and_hash[..22], and &salt_and_hash[22..]. None of these were char-boundary-checked. Any input where a multi-byte UTF-8 character spanned one of those byte positions caused a panic.

This is a regression of the fix originally shipped in 2021 for issue #62 (commit 0833509). The regression was introduced in the parser rewrite in PR #95 (commit e9a8394, released as 0.19.0).

The pre-existing regression test does_no_error_on_char_boundary_splitting was not removed, but was silently rendered ineffective by the new bytes[0] != b'$' guard, which rejected its input earlier and prevented it from reaching the buggy slices — leaving CI green through the regression.

Fix

split_hash now rejects any hash string containing non-ASCII bytes up front. A valid bcrypt hash is always exactly 60 ASCII bytes, so this closes the entire class of byte-boundary panics rather than guarding each slice individually.

The fix was merged in PR #103 and released as bcrypt 0.19.2 on 2026-06-20.

Downstream impact

pyca/bcrypt (which depended on bcrypt 0.19.1) is not affected. Its Python-side wrapper performs its own byte-level salt parsing before invoking bcrypt::hash_with_salt, and never reaches the buggy code path in split_hash or verify.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0201: Vulnerability in fulgur

2026-07-04T12:00:00+00:00

RUSTSEC-2026-0201

Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Reported

July 5, 2026

Issued

July 4, 2026

Package

fulgur (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#dos #pagination #pdf

Aliases

GHSA-4rf6-qx84-q9fv

References

https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-4rf6-qx84-q9fv

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.26.0

Description

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output.

The childless-collapse defense that would normally collapse such a box was gated by a tag-only "replaced content" check, so any non-painting replaced element bypassed it, including an unresolved src (the common offline-first case), a visibility:hidden image, an undecodable image format, and an empty <svg>. A trailing-sibling variant of the same gap was also open.

A few bytes of HTML therefore amplified into roughly MAX_PAGES (10,000) blank pages; the renderer allocates and runs a per-page loop over them, producing CPU and memory exhaustion. An attacker able to submit HTML to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.

Fixed in 0.26.0: the tag-only gate was removed so that any pathologically tall childless box collapses regardless of whether it is a replaced element, closing the missing-src, visibility:hidden, undecodable-format, and empty-<svg> vectors along with the trailing-sibling variant.

Versions prior to 0.19.0 additionally lacked any page-count cap, allowing an unbounded (rather than 10,000-page) variant of this amplification; that earlier variant is tracked separately as GHSA-j5cx-ph8g-95v3.

Attack Vector rationale

fulgur performs no network I/O of its own; it renders HTML/CSS handed to it by the embedding application. This advisory scores the crate independent of any specific adopting program, so per the CVSS v3.1 User Guide §3.7 the Attack Vector is assessed as Network for the reasonable worst-case deployment — a network-facing service that renders untrusted HTML without user interaction. A concrete system that receives the HTML in one component and passes it to fulgur in a separate component may assess a lower environmental Attack Vector (Local, per §3.10).

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0200: Vulnerability in fulgur

2026-07-04T12:00:00+00:00

RUSTSEC-2026-0200

Unbounded page slicing from attacker-controlled CSS height causes denial of service

Reported

July 5, 2026

Issued

July 4, 2026

Package

fulgur (crates.io)

Type

Vulnerability

Categories

denial-of-service

Keywords

#dos #pagination #pdf

Aliases

GHSA-j5cx-ph8g-95v3

References

https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-j5cx-ph8g-95v3

CVSS Score

7.5 HIGH

CVSS Details

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Patched

>=0.19.0

Description

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound.

The height is taken directly from attacker-controlled HTML/CSS (height, vh units), so a few bytes such as <div style="height:99999999px"></div> forced on the order of 125,000 page fragments. The pagination code then allocates vec![Vec::new(); page_count] and runs a per-page render loop, resulting in CPU and memory exhaustion. A non-finite height (one that resolves to +inf) additionally made the slicing loop's remaining -= last_slice_h decrement never terminate, causing an infinite loop.

An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger this with a trivially small payload, denying service to the host and any co-tenants.

Fixed in 0.19.0: a MAX_PAGES cap bounds the slice loop — halting it even for a +inf height — and non-finite layout heights are sanitized so they can no longer drive the loop.

Attack Vector rationale

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0198: Unsoundness in error-stack

2026-07-03T12:00:00+00:00

RUSTSEC-2026-0198

Report::frames_mut allows aliased mutable references

Reported

July 3, 2026

Issued

July 3, 2026

Package

error-stack (crates.io)

Type

INFO Unsound

Categories

memory-corruption

Keywords

#aliasing

References

Patched

>=0.8.0

Affected Functions

Version

error_stack::Report::frames_mut

Description

Affected versions of this crate return an iterator from Report::frames_mut whose &mut Frame items have lifetimes independent of the iterator, so all yielded references can be held at the same time. A yielded frame's sources are also yielded by the iterator and reachable through the parent frame via Frame::sources_mut, allowing safe code to obtain two live mutable references to the same frame. This is undefined behavior and can be used to cause a segmentation fault (see reproducer in the linked issue). Versions 0.1.0 and 0.1.1 are affected through Frame::source_mut instead of Frame::sources_mut.

The flaw is fixed in 0.8.0 by replacing the iterator with internal iteration: Report::frames_mut now takes a visitor closure, so mutable access to a frame is scoped and cannot overlap with access to its sources.

Advisory available under CC0-1.0 license.

RUSTSEC-2026-0196: cgmath is unmaintained

2026-07-03T12:00:00+00:00

RUSTSEC-2026-0196

cgmath is unmaintained

Reported

July 1, 2026

Issued

July 3, 2026

Package

cgmath (crates.io)

Type

INFO Unmaintained

References

Patched

no patched versions

Description

The cgmath crate is no longer maintained.

Users should consider switching to a maintained alternative.

Advisory available under CC0-1.0 license.