Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-123613Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypasscrates.io · rustls · fixed in 0.23.45
- CVE-2026-123612rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosurecrates.io · rustls · fixed in 0.23.46
- CVE-2026-123611rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHellocrates.io · rustls · fixed in 0.23.46
- CVE-2026-123610rustls before 0.23.46 Denial of Service via Brotli Certificate Decompressioncrates.io · rustls · fixed in 0.23.46, 0.24.0-dev.2
- CVE-2026-123609Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debugcrates.io · rustls · fixed in 0.23.46
- CVE-2026-123608Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compressioncrates.io · hickory-proto · fixed in 0.26.1
- CVE-2026-123607Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Servicecrates.io · hickory-net, hickory-proto · fixed in 0.26.1, 0.26.0-beta.1
- RUSTSEC-2026-0443Hidden file disclosure through Windows short namescrates.io · actix-files · fixed in 0.7.4
- RUSTSEC-2026-0445Degraded secret zeroization capabilitiescrates.io · vodozemac · fixed in 0.11.2
- RUSTSEC-2026-0446Request smuggling through malformed chunked request trailerscrates.io · actix-http · fixed in 3.20.2
- RUSTSEC-2026-0447Compressed request bodies can exhaust memory before extractor limits applycrates.io · actix-web · fixed in 4.18.2
- RUSTSEC-2026-0448Unbounded decompression can exhaust memory and CPU resourcescrates.io · actix-http · fixed in 3.20.1
- RUSTSEC-2026-0451Degraded secret zeroization capabilitiescrates.io · vodozemac · fixed in 0.11.2
- RUSTSEC-2026-0455Large-window Brotli bodies bypass decompression memory limitscrates.io · actix-http · fixed in 3.20.3
- RUSTSEC-2026-0449`ocipkg` is unmaintainedcrates.io · ocipkg
- RUSTSEC-2026-0462Unbounded response body buffering in Streamable HTTP clientscrates.io · rmcp · fixed in 3.9.0
- RUSTSEC-2026-0456Panic on an HEVC tile layout that does not match the active SPScrates.io · heifer-hevc-dec · fixed in 0.3.27
- RUSTSEC-2026-0458Memory exhaustion when parsing a crafted `iloc` boxcrates.io · heifer-isobmff · fixed in 0.3.27
- RUSTSEC-2026-0460Panic on chroma QP offsets enabled with an empty offset listcrates.io · heifer-hevc-dec · fixed in 0.3.27
- CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingcrates.io · wasmtime-wasi-http · fixed in 36.0.19, 48.0.7, 49.0.4
- CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypasscrates.io · wasmtime-wasi-http · fixed in 48.0.7, 49.0.4
- CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-httpcrates.io · wasmtime-wasi-http · fixed in 48.0.7, 49.0.4
- RUSTSEC-2026-0440`astral-tokio-tar` is unmaintainedcrates.io · astral-tokio-tar
- RUSTSEC-2026-0452Out-of-bounds read when decoding internal keys shorter than 16 bytescrates.io · surrealkv · fixed in 1.2.0
- RUSTSEC-2026-0454Data race and double free via unsound `Send`/`Sync` in `reblessive`crates.io · surrealdb-core · fixed in 4.0.0
- CVE-2026-111959Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds readscrates.io · arrow, arrow-data · fixed in 60.1.0, 57.3.2, 58.4.1 and more
- RUSTSEC-2026-0430Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)crates.io · rio-vt · fixed in 0.5.29
- RUSTSEC-2026-0431Unbounded memory allocation in `evtx` parsing a `.wevtcache` filecrates.io · evtx · fixed in 0.15.1
- RUSTSEC-2026-0432`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)crates.io · codeq · fixed in 0.6.3
- RUSTSEC-2026-0434`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)crates.io · ant-releases