### Summary `libp2p-quic` can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp2p TLS certificate and delays the final TLS 1.3 handshake fragment until the certificate expires. This is remotely reachable by a network peer and can crash applications exposing a libp2p QUIC listener. ### Details During the TLS handshake, `libp2p-tls` parses and validates the

本文提出了一套面向密码学软件的全新形式化验证方法论，其核心取向是直接验证“生产级代码”，而不是为了便于验证而专门改写代码。作者选择 Rust 作为目标语言，看重的是它在性能与系统集成方面的优势：Rust 的所有权机制使 Aeneas 工具链能够把 Rust 代码抽取为 Lean 中的纯函数模型，从而免除对指针存活性、别名关系等底层细节的推理负担；Lean 的可扩展性又允许团队开发专用的策略（tactic）与库，大幅简化对抽取后代码的推理。工具链被专门设计并调优以配合 AI：智能体可以自主撰写形式化证明，这些证明由 Lean 内核独立校验；智能体还参与密码标准与平台相关 intrinsic 的形式化工作，但这部分仍需专家主导设计与评审。作者将该方法应用于微软的密码提供者 SymCrypt，验证了从其 C 版本移植到 Rust 的 SHA-3、ML-KEM 等算法实现；并进一步用实验性优化以及 FrodoKEM、ML-DSA、HPKE 等算法的实现来扩展 SymCrypt，以考察编写、移植与验证密码代码的可扩展性。整个 Lean 开发规模约 237 KLOC，为 16.7 KLOC 的 Rust 代码（覆盖 x86-64 与 ARM 平台上的后量子密码套件）建立了内存安全性、无 panic 以及功能正确性的证明。评估结果显示，经过验证的 Rust 实现能够满足 SymCrypt 在性能、可移植性、部署方式与可维护性方面的要求。

## Unbounded Remote Media Fetch and Video Frame Expansion DoS ### Summary The `POST /v1/chat/completions` endpoint in mistral.rs fetches attacker-supplied media URLs (image, audio, video) into server memory with no byte limit, and extracts every frame of a supplied video when `num_frames` is `None`. An unauthenticated remote attacker can exhaust server memory, disk space, and CPU by pointing the

### Summary mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary local files (a `file://` URL, or any existing relative/absolute path). A remote, unauthenticated client of any vision/audio deployment can cause the server to issue requests to internal or cloud-metadata addresses (SSRF) and to open arbitrary local files, via the standard OpenAI `

A `PERMISSIONS ... WHERE` clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cannot write. For example: ```surql DEFINE TABLE post PERMISSIONS FOR update WHERE (CREATE log SET

An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different namespace/database, reaching another tenant's endpoint. The route `/api/{namespace}/{database}/{endpoint}` took the namespace and database from the URL and applied them to the caller's session before the endpoint was looked up or run, without checking that the caller's authenti

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary A malicious `.codewhale/config.toml` or `.deepseek/config.toml` com

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary The `rlm_eval` tool runs an arbitrary Python string chosen by the mo

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. # Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Appr

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary DNS-pinning failure allows natural failure of code, however with a c

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary js_execution exposes parent process environment to model-provided J

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. # Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Appr

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary `exec_shell` is correctly approval-gated. Its sibling `exec_shell_in

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary A malicious `.codewhale/config.toml` or `.deepseek/config.toml` com

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary image_analyze follows workspace symlinks and leaks outside-workspac

SurrealDB offers http functions that can access external network endpoints. A typical, albeit [not recommended ](https://surrealdb.com/docs/surrealdb/reference-guide/security-best-practices#example-deny-all-capabilities-with-some-exceptions)configuration would be to start SurrealDB with all network connections allowed with the exception of a deny list. For example, `surreal start --allow-net --den

## The Bug Hurl <= 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the [Header]/headers area 2. In a dedicated [Cookies] section (parsed into RequestSpec.cookies) When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring

### Impact Wasmtime's native implementation of WASIp1 suffers from a leak in the `fd_renumber` function where the file descriptor being renumbered to is not properly closed. Wasmtime's implementation erroneously only updated the table of descriptors for WASIp1 and didn't update the underlying table of descriptors used by the host. This behavior means that while `fd_renumber` works correctly from

### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled (and no SRTP/DTLS protection) can craft a forged COOKIE-ECHO chunk that passes all validation, establish

When using the affected versions of the `vibeio-http` crate, an attacker could craft a malicious HTTP/1.x request with a large chunk length (between `usize::MAX - 1` and `usize::MAX` inclusive) and send it, causing the server to crash (integer overflow panic in debug builds, split_to out of bounds panic in release builds). This was fixed in `vibeio-http` 0.3.2 by erroring on the chunk length if i

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking `try_get`, and both `Row` and `SimpleQueryRow`. Applications that connect only to a trusted database are not exposed; the risk applies

A malicious or compromised server can return a binary `hstore` value with an invalid internal length field, causing the client to panic while decoding it. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a `tokio` worker thread for minutes per connection, possibly stalling the whole async runtime. Applications that connect only to a trusted database are not exposed; the risk applies to clients that

该论文对 Rust 在安全后端开发中的适用性进行了批判性回顾与扩展性漏洞比较。作者首先回顾了既有关于 Rust 安全性的工业研究，指出现有分类法（基于 SANS Top 25、OWASP Top 10 和 19 Deadly Sins 框架）在将 Rust 与 C/C++/Java 对比时存在经验验证不足、访谈样本小、以及缺少安全开发生命周期讨论等局限。随后，论文原创性地将 Rust 与 Node.js 和 Django 进行三层次分类（罕见且困难、有防护、无防护）比较，并针对越界写入（CWE-787）、释放后使用（CWE-416）和竞态条件（CWE-362）设计了并排代码实验。结果表明，Rust 的编译期保证在系统层占优，而受管理的后端框架在应用层提供更强的内置防御。作者据此认为，在 Web 开发中采用 Rust 不能仅依赖语言级安全性，还需配套补充防护措施。该研究适用于关注语言安全特性选型、后端架构安全设计及安全开发流程的工程师与决策者。

### Summary A caught panic may leave the cursor position of `EagerBuffer` or `ReadBuffer` in a corrupted state; this in turn allows out-of-bounds reads/writes. ### Details & PoC The following two tests fail miri: ```rust #[cfg(miri)] #[test] fn eager_digest_blocks_panic_corrupts_inline_position() { // `EagerBuffer` stores its cursor in the last byte of the internal block. // When `dige

The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents. Any application using instruction `sponge_absorb_mem` to hash memory data can be given a proof for a forged hash that doesn't correspond to the actual memory. This breaks the security of memory-ba

本文针对C语言内存安全加固研究中普遍存在的“单漏洞类孤立评估”问题，提出了一种全新的跨语言比较评估范式。过去数十年，研究者提出了许多针对C语言的内存安全回填机制，但这些机制几乎总是在孤立条件下、针对特定漏洞类型进行评估，导致实际工程实践中难以判断多种防御机制叠加后带来的综合性能开销、互操作冲突和保护覆盖缺口。作者主张应像评估原生内存安全语言（如Rust和Go）那样，对C语言的复合加固方案进行整体性基准测试。为此，他们设计了一套标准化的跨语言任务集，同时部署多种先进的内存安全回填机制，并测量其组合使用时的性能与防护效果。实验结果显示，分层部署的C语言防御机制会带来累积的、依赖工作负载的性能惩罚；部分机制之间存在根本性的架构不兼容；即便叠加多项加固，其防护范围仍无法达到Rust或Go等原生安全语言的水平。这些发现揭示了一个关键的工程决策缺口：在遗留C代码库中向后移植安全特性的真实成本往往被隐藏，使开发团队难以在加固旧系统和迁移到现代安全语言之间做出明智选择。作者因此呼吁内存安全研究领域应放弃孤立评估模式，转向更全面、可比较的评估框架，以帮助高风险决策（如是否重写系统）建立在可靠的数据基础上。该研究对系统软件、嵌入式设备、网络服务等依赖C语言的高危场景具有重要参考价值，也为安全团队评估长期投入方向（是修补还是迁移）提供了方法论支撑。

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on an s2n-quic endpoint by sending crafted CRYPTO frames with high offsets. The buffer used for processing CRYPTO frames does not enforce a maximum size. In the worst case, a single 1200-byte packet can cause approximately 9.4 MB of allocation. By repeatedly sending such packets, th

A `SELECT` permission defined on an array element (`DEFINE FIELD field.* … PERMISSIONS FOR select …`) is not enforced correctly for `RECORD` users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexed elements, and a per-element predicate keeps and drops the wrong ones. The filter removed each denied element by index while walking the array f

本论文（arXiv 论文，标题为《Oxidizer: Toward Concise and High-fidelity Rust Decompilation》）提出了一款名为 Oxidizer 的 Rust 反编译工具或框架，旨在解决 Rust 二进制程序反编译结果不够简洁且保真度不足的问题。论文作者来自多个学术与安全研究机构（包括亚利桑那州立大学等），研究方向集中在程序分析、逆向工程与二进制安全。由于当前仅提供论文摘要（本输入中摘要内容缺失），无法获取具体的技术架构、实验设计或定量评估指标。从标题和学科背景推断，Oxidizer 可能利用 Rust 类型系统、所有权模型以及编译器中间表示等特有信息，来提升反编译代码的可读性和语义准确性，从而帮助逆向工程师更高效地分析 Rust 编写的软件。本文的主要贡献可能包括：提出一种针对 Rust 语言特性的反编译方案、设计新的中间表示转换或控制流恢复算法、以及在真实 Rust 编译产物上展示相比现有反编译器的改进。该研究面向安全分析人员、编译器开发者以及二进制逆向工程师，有助于提升 Rust 目标程序的漏洞分析与恶意代码检测能力。由于缺少具体摘要内容，所有细节均为基于标题的合理推断，阅读原文可获得确切结论。

### Impact The validity store treats a transaction with stored `block_number = X` as "in window" only when `X > last_bn - transaction_validity_window_blocks` (strict inequality). However the protocol's `Transaction::is_valid_at` accepts a transaction for inclusion in any block in `[validity_start_height - blocks_per_batch, validity_start_height + window - 1]`. By choosing `validity_start_height =

本文研究信息流分析（Information Flow Analysis）在真实系统中的应用问题。信息流分析是评估机密性和完整性的主要方法，但实际采用率不高，根本原因在于理论与实践的差距：现有技术通常假设安全策略是静态的（即数据保密性不变），而真实系统中的安全关注往往是动态的。已有大量研究尝试解决这一差距，例如引入降级（declassification）、背书（endorsement）和调用策略等。近期一项工作提出了“动态释放”（dynamic release）策略，通过允许信息流限制以任意方式降级或升级，统一了先前的各种形式化方法。然而，如何可靠地实施这一强大的动态释放策略仍是开放问题。本文首次提出了一个能够强制动态释放策略的类型系统，并正式证明了其可靠性。具体贡献包括：(1) 形式化了一个支持动态释放策略的核心语言；(2) 开发了一个检查动态释放策略的类型系统；(3) 提出了新的证明技术，并正式证明了该类型系统确实强制动态释放策略；(4) 实现了一个作为Rust语言扩展的原型系统，并在会议评审系统和Civitas（电子投票系统）上进行了案例研究。本文是形式化方法在安全策略实施方面的重要进展，适合编程语言理论、安全策略形式化以及信息流控制相关方向的研究人员和工程师阅读。

本文提出 deepSURF，一种结合静态分析与大语言模型（LLM）引导的模糊测试工具，用于检测 Rust 库中的内存安全漏洞，尤其针对 unsafe 代码。尽管 Rust 默认保证内存安全，但 unsafe 代码的使用可能引入安全漏洞。现有工具在检测能力、处理 Rust 特有类型或减少人工干预方面存在不足。deepSURF 引入了一种处理泛型的新方法：通过自定义类型替换泛型，并为所需 trait 生成定制实现，使模糊测试器能够在被测库中模拟用户定义的行为。此外，deepSURF 利用 LLM 动态增强模糊测试 harness，以探索复杂的 API 交互，显著增加暴露内存安全漏洞的可能性。作者在 63 个真实世界的 Rust crate 上进行了评估，成功复现了 30 个已知内存安全缺陷，并发现了 12 个先前未知的漏洞（其中 11 个已分配 RustSec ID，3 个已修复），显示其相对于最先进工具的明显改进。这篇论文的主要贡献在于提出一种自动化程度更高的漏洞发现框架，结合 LLM 提升模糊测试的覆盖率和有效性，并针对 Rust 特有挑战提供了解决方案。适合 Rust 安全研究人员、模糊测试工具开发者以及关注内存安全漏洞的蓝队成员阅读。

Rust作为一种系统编程语言，以其强内存安全性和低性能开销而闻名。通过所有权、借用等严格安全策略，Rust编译器能够保证大部分代码的内存安全。然而，在unsafe代码块中，这些安全策略并未完全启用，导致内存错误仍可能发生。尽管这类unsafe代码通常仅占整个代码库的一小部分（例如10%），但现有模糊测试工具往往对整个程序进行测试，包括已经由编译器保证安全的safe Rust代码，从而浪费了大量模糊测试资源。针对这一问题，本文提出了RustGo，一种新型的面向Rust的定向灰盒模糊测试工具。RustGo能够高效且公平地聚焦于可能包含内存错误的代码区域。其核心方法包括：利用Rust特定的静态分析自动识别潜在的内存错误目标，并精准地剪枝与每个目标无关的路径；针对每个识别出的目标，采用独立状态维护和动态剪枝策略，以实现平衡且聚焦的模糊测试。研究者在多个真实世界的Rust应用上进行了评估，结果表明RustGo平均剪枝了78.49%的无关路径，到达目标的速度比现有模糊器快2.09至5.08倍，并成功发现了13个未知错误（其中6个被分配了RUSTSEC ID，1个被分配了CVE ID）。这项工作显著提升了Rust unsafe代码安全检测的效率和效果。

There is a server-side channel state issue in `russh`. After a client is authenticated, `russh` can dispatch channel-scoped handler callbacks for recipient channel IDs that were never opened or confirmed. In the strongest reproduced case, the client does not send `SSH_MSG_CHANNEL_OPEN` at all. It authenticates normally, then sends `SSH_MSG_CHANNEL_REQUEST` packets with request type `exec` for a r

### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks until it finds a common ancestor on the main chain. It has **no recursion depth limit** and **no cycle detection**. A malicious or buggy validator can serve a block whose `previous_block_hash` points back to itself (or forms a cycle with other blocks), causing `handle_reorg` to infin

### Impact `skilo add` installs a skill by recursively copying the skill directory into the target skills directory. The copy routine (`copy_dir_all`) classified each entry with `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and then copied non-directory entries with `std::fs::copy()`, which **does** dereference symlinks. As a result, a skill containing a symbolic link s

## Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of servi

## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. ## Affected behavior Native `reqwest::Error` values retain the full request URL. Converting those errors into `ApiError::Http`, or exhausting retries and storing the error text in `ApiError::RetryExhausted

## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams. ## Impact Applications may use a custom transport as

## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared or

Rust语言的所有权模型和类型系统提供了强大的内存安全保障，但unsafe代码和运行时panic依然带来显著风险。形式化验证是确保内存安全的关键，然而开发验证harness（验证框架）是一项具有挑战性的手动任务。虽然大语言模型在各类代码分析任务中表现出色，但直接将其应用于harness生成往往导致API调用不准确、非确定性数据生成低效以及虚假的修复。本文提出HarnessLLM，一种自动化工作流，利用LLM直接从现有测试套件为Rust代码生成验证harness。HarnessLLM自动从测试用例中提取调用场景，基于依赖分析生成非确定性参数，并增量式合成harness。随后迭代优化harness，保留关键代码区域，并将虚构的类型或函数报告给LLM进行修正。在9个真实世界Rust代码库上的评估中，HarnessLLM从494个测试用例中提取了294个调用场景，准确率94.66%，平均每个场景生成harness耗时145秒。其性能优于现有方法Autoharness，后者仅能处理41%的场景。最终，生成的harness检测到6个真实内存安全漏洞，证明了该方法在验证中的实用价值。据作者所知，这是首个利用LLM为真实Rust项目生成面向内存安全验证的harness的工作。

该论文提出了 KaPilot，一个基于大语言模型（LLM）的多智能体框架，用于自动生成 Rust 语言中 unsafe 代码内存安全的形式化规约（specifications），以支持使用 Kani 验证器进行形式化验证。Rust 的所有权和类型系统提供了强内存安全保证，但 unsafe 代码仍存在内存安全风险。形式化验证可以确保内存安全，但为 unsafe Rust 编写精确规约具有挑战性且高度依赖人工。LLM 在生成形式化规约方面显示出潜力，但通常以代码为中心，容易继承实现缺陷，且缺乏系统化的质量评估。KaPilot 流程首先进行轻量级程序分析和证明桩生成。SafetyReq 智能体从目标 Rust 函数的文档中提取精炼的安全需求列表，引导 SpecGenerate 智能体生成初始规约，指定内存安全问题。然后，通过包含 SpecGenerate、SpecPrecheck 和 SpecVerify 智能体的生成-预检-验证循环迭代优化规约，评估质量并反馈错误。多次执行该循环后，KaPilot 生成一组候选规约。最后，应用 shuffle（打乱）和 implication（蕴含）策略系统地从候选中确定最佳规约。作者在 54 个具有真实标注的 unsafe Rust 函数和 70 个无标注的函数上评估了 KaPilot。在有真实标注的数据集上，规约生成成功率达到 88.9%；在无标注数据集上为 71.4%。其中 57.4% 的生成规约与真实标注等价或更强。与 AutoSpec 基线相比，KaPilot 生成了多 14.8% 的可验证规约和多 25.9% 的等价或更优规约。该研究展示了 LLM 在自动化形式化验证规约生成方面的潜力，为提升 unsafe Rust 代码安全性提供了新方法。

## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process. ## Affected packages - PyPI `prompty` versions `<= 2.0.0b1`; fixed in `2.0.0b2` -

本论文针对 Rust 语言中解析和序列化操作的安全性与性能挑战，提出了一种名为 Vest 的新型框架。Rust 以其内存安全著称，但手写解析器和序列化器仍然容易出错且效率低下。现有方案（如 serde）虽提供自动化，但缺乏形式化验证，且难以应对复杂格式。Vest 结合了形式化验证与高性能实现：首先，用户使用一种安全领域专用语言（DSL）描述数据格式规范；然后，Vest 自动生成经过验证的解析器和序列化器代码。其核心创新在于利用符号执行和 SMT 求解器对生成的代码进行属性验证（如内存安全、无崩溃、格式合规），同时通过编译器优化和运行时技术（如零拷贝、预分配）保持接近手写代码的性能。实验在多个实际数据格式（如 JSON、MessagePack、FlatBuffers）上评估，结果显示 Vest 不仅消除了常见漏洞（如缓冲区溢出、未定义行为），而且性能与 serde 相当或更优，在某些场景下提升高达 30%。该工作为 Rust 生态系统提供了安全与效率兼顾的解析/序列化基础设施，适合编译器工程师、形式化方法研究者及系统程序员阅读。

### Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted `TrieChunk` whose proof contains a `TrieNodeChild` whose `suffix`, when concatenated with the parent key via `KeyNibbles::Add`, exceeds the fixed 63-byte backing array. `Add` (`primitives/src/key_nibbles.rs:332` / `:341`) indexes `bytes[self.bytes_len()..self.bytes_len() + other.bytes_len()]` with no

### Impact A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted `TrieChunk` whose proof contains two `TrieProofNode`s with identical keys. `TrieProof::verify()` calls `TrieProofNode::child_index()` (`primitives/src/trie/trie_proof_node.rs:94`), which unconditionally unwraps `KeyNibbles::get(self.key.len())`. Because `is_prefix_of` returns `true` for two equ

Diesel allows loading a SQLite database from a byte buffer, represented as `&[u8]`, at runtime via the `SqliteConnection::deserialize_readonly_database` function. In previous versions of Diesel, this buffer was passed directly to libsqlite3. Since libsqlite3 requires the buffer to remain alive for as long as the database connection is open and Diesel did not ensure this as part of its safe API, ca

### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = "KeyValueMap")]` can be crashed by an empty inner sequence or map entry. ### Details The affec

A method within the `exploration` crate attempted to download and execute a payload from a remote site. The malicious crate had 1 version published on 2026-06-02, approximately 1 hour before removal, and had no evidence of actual usage. This crate had no dependencies on crates.io. Rustsec to Kirill Boychenko from the [Socket Threat Research Team](https://socket.dev/) for reporting this crate.

### Summary A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{workspace}/scripts/list_search`. This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware validates the token domain/action, but does not enforce the resource/path segment of a scope. `scr

`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the `ratter_cache` code used the package record `build` string as part of a cache key that was joined into a filesystem path. A malicious or untrusted channel could publish repodata with path separators or traversal components in that f

Affected versions of `oneringbuf` exposed the obsolete `IntoRef::into_ref` method through the public `IntoRef` trait. For heap-backed ring buffers, this method returned a `DroppableRef` handle. `DroppableRef` stored an owning raw pointer created from `Box::into_raw`. Its `Clone` implementation copied this raw pointer without incrementing the internal `alive_iters` counter. Internally, this clone

## Summary `async-tar` v0.6.0 mis-applies a buffered PAX `size` extension to an intermediary extension header (a GNU longname `L`, a GNU longlink `K`, or a PAX `x`/`g` header) instead of to the next *file* entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening extension header. Because `poll_next_raw` (`src/archive.rs`) threads the buffered PA

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 ## Summary `plabayo/rama` contains a stored/reflected cross-site scripting issue in the `ServeDir` HTML directory listing feature. When `ServeDir` is configured with `DirectoryServeMode::HtmlFileList`, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an

### Summary RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with **no maximum depth limit**. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of pani

### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with **byte** indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“by

`determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `BackupMode::None` when only `--suffix` is given. GNU enables backup mode when `--suffix` is used alone (defaulting to existing/numbered, or `$VERSION_CONTROL`). Affects `cp`, `install`, `mv`, `ln` which share this code. ``` # uutils: no backup created $ coreutils cp --suffix=.bak sr

`cut` routes `-z -d ''` through a special newline-delimiter path that ignores the `-s` only-delimited flag, emitting whole undelimited records (plus NUL) that should be suppressed. Pipelines relying on `cut -s` to drop undelimited records process data that should be filtered. ``` printf 'abc' | cut -z -d '' -s -f 1 | od -An -tx1 # GNU: no output ; uutils: 61 62 63 00 ``` --- _Zellic private fin

uutils calls `mknod` *before* setting the SELinux context (GNU uses `setfscreatecon` first, labeling atomically). If `set_selinux_security_context` fails, cleanup uses `std::fs::remove_dir`, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind. **Impact:** on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mis

When `mkfifo()` fails (e.g. target already exists), the code shows an error but is missing a `continue;`, so it falls through to `fs::set_permissions` and changes the permissions of the pre-existing file to the default FIFO mode (`0o666` & umask -> `0644`). ``` $ touch secret; chmod 000 secret $ coreutils mkfifo secret fifo3 fifo4 mkfifo: cannot create fifo 'secret': File exists $ ll secret

### Summary A soundness vulnerability in the variable-base scalar multiplication gadget of `halo2_gadgets` allowed a malicious prover to produce a valid proof for an Orchard Action with an *under-constrained* base point. Because this gadget enforces the diversified-address-integrity condition of the Orchard Action statement, the flaw let a prover satisfy that condition for an arbitrary (pkd, gd,

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administr

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions. ---

When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a `etc_link -> /etc` inside the source becomes a full copy of `/etc` at the destination. **Impact:** (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service

`rm -rf .` is correctly refused, but `clean_trailing_slashes` normalizes `.///` to `./` while `path_is_current_or_parent_directory` only matches `.`/`..` (and `/.`/`/..`), not `./` or `../`. So `rm -rf ./` recursively deletes the directory's contents and then prints a misleading `cannot remove './': Invalid input`. **Impact:** all files/subdirectories in the current directory are silently deleted

The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepa

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially lea

The `--preserve-root` check uses a path-string test (`path.has_root() && path.parent().is_none()`) rather than comparing device/inode. A symlink to `/` (e.g. `/tmp/rootlink -> /`) has a parent component, so it passes the check. GNU caches `/`'s dev/inode at startup and compares every traversed directory against it. **Impact:** `rm -rf --preserve-root` on a path that resolves through a symlink to

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisi

`kill -1` is incorrectly parsed as a positional `pid = -1`; combined with the default SIGTERM this calls `kill(-1, SIGTERM)`, signaling nearly every process the caller can see. GNU `kill` recognizes `-1`/`-9` as signals and reports "not enough arguments". ``` $ kill -1 # uutils: kill(-1, SIGTERM) -> mass termination / crash $ kill -1 # GNU: kill: not enough arguments ``` **Impact:*

The `-D` path runs `fs::create_dir_all` on a pathname then later opens the destination via path-based `File::create`/`fs::copy`, neither anchored to a directory fd. Between the two, an attacker can replace a path component with a symlink, redirecting the write. **Impact:** an attacker with concurrent write access to the destination tree can redirect a privileged `install -D` to an arbitrary locat

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing the utility to print non-delimited lines that should have been suppressed. This can lead to unexpected data being passed to downstream scripts

`copy_file` in `install/src/install.rs` removes the destination then recreates it by pathname via `File::create` / `fs::copy` without `O_EXCL`/`create_new`. Between the unlink and the recreate, a local attacker with write access to the destination directory can drop in a symlink and redirect the write. **Impact:** when `install` runs privileged into an attacker-writable directory (staging/build p

In target-directory forms (`ln SOURCE... DIRECTORY`), `ln` rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems. PoC: ``` name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst # GNU: exit 0, creates dst/bad_\377 ; uutils: exit 1, dst empty ``` --- _Zellic private finding (zellic-ext/coreut

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD). This behavior differs from GNU comm, which processes raw bytes and preserves the original input. This results in corrupted output when the

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more per

In `Chmoder::chmod()` the recursive branch overwrites the running result instead of accumulating it, so the exit code reflects only the *last* file processed: ``` if self.recursive { r = self.walk_dir_with_context(file, true); // overwrites r } else { r = self.chmod_file(file).and(r); } ``` **PoC:** GNU returns 1 when a file fails; uutils returns 0 if the last entry succeeds: ``` $ ch

### Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. ### Details & PoC The test listed below fail under miri with command `cargo +nightly miri test --release -p jxl-grid` Or you can use Address Sanitizer, which ignores Rust-specific UB like aliasing but still flags out-of-bounds accesses: `RUSTFLAGS=-Zsanitiz

### Summary `jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize` multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however norm

### Summary Logic bug in `decode_simple_table_slow` may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with `overflow-checks` enabled. ### Impact Denial of service: any application passing untrusted JXL data to `JxlImage::render_frame` (or equivalent) can be crashed. Affects all builds with overflow checks enabled, which includes debug

### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node listens on the default `[::]` address on a Linux host (the standard deployment configuration — `net.ipv6.bindv6only=0` is the default on all common Linux distributions). 3. Your node is synced near the chain tip (the expected production state for any node participating in the network). ### Summ

In SurrealDB, records can be connected as a graph: a `RELATE` statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent. A user with permission to delete a node could also delete the edges connected to that node, even when the edge table's `PERMISSIONS FOR delete` clause should have stop

When a user configures `ALGORITHM ES512` for any JWT access method (`DEFINE ACCESS ... TYPE JWT ALGORITHM ES512`), SurrealDB silently substitutes ES384 at all four internal algorithm conversion points. This occurs because the underlying `jsonwebtoken` crate (v10.x) does not include an ES512 algorithm variant, so the mapping defaults to ES384 without raising an error, warning, or log message. Use

A record user could learn the value of a hidden field by counting how many records match a guess. When `DEFINE FIELD ... PERMISSIONS FOR select WHERE ...` hides a field's contents from a caller, and that field is indexed, running `SELECT count() FROM t WHERE hidden_field = "guess" GROUP ALL` returned a count greater than zero whenever a record actually had that value — even though the caller was

An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding `DEFINE NAMESPACE` or `DEFINE DATABASE` permission. `USE NS ` and `USE DB ` automatically create the target when it does not exist. The three places `USE` is handled — the RPC `use` method, `Datastore::process_use`, and the SurrealQL executor — did not check whether the caller was allowed

SurrealDB offers `http::*` functions that can access external network endpoints, with the `--allow-net` and `--deny-net` capabilities used to restrict the set of network targets that can be reached. An authenticated user of SurrealDB can bypass a port-scoped `--deny-net :` rule by chaining an HTTP redirect: the initial request goes to an `--allow-net`-permitted hostname, the response's `3xx Locati

A record user could read records the table's SELECT permission expression should have hidden, when that expression referenced `$value`, `$before`, `$after`, or `$event`. Binding a chosen value to that name before registering a `LIVE SELECT` caused notifications to evaluate the permission against the attacker's input instead of the real document. ### Impact A record user binds a value to `$value`

本文以Rust语言为案例，系统研究了采用安全编程语言对软件安全性和开发实践的影响。研究背景在于内存安全漏洞（如缓冲区溢出、释放后使用）是现有C/C++程序的主要安全威胁，而Rust通过所有权、借用检查等机制在编译期消除这些漏洞。然而，迁移到Rust存在学习曲线、与现有代码集成困难、运行时性能开销等顾虑。作者通过混合方法开展研究：首先对开源项目使用Rust的情况进行定量分析，测量漏洞密度与模式；其次对开发者进行深度访谈与调查，收集采用Rust的动机、障碍与经验；最后通过实验对比Rust与C/C++在性能、代码复杂度、可维护性上的差异。主要贡献包括：(1) 提供了Rust减少内存安全漏洞的实证证据，但指出逻辑错误和非内存安全缺陷仍需关注；(2) 量化了学习成本与代码迁移工作量；(3) 提出组织采用Rust时应考虑的因素，如团队现有技能、项目风险容忍度、对互操作性的需求。本文适合安全工程师、技术决策者及编程语言研究者阅读，为评估是否将Rust引入安全关键系统提供依据。

The Rust Security Response Team was notified that Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. This vulnerability is tracked as CVE-2026-5223. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io a

The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the [sparse index protocol][1]. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. This vulnerability is t

## Impact Following the path-safety patches in [GHSA-wx3m-whqv-xv47](https://github.com/umanio-agency/skillctl/security/advisories/GHSA-wx3m-whqv-xv47) (v0.1.2), a comprehensive multi-angle audit surfaced five further vulnerabilities, now patched in v0.1.3: 1. **`source_sha` argument injection in `git ls-tree` (CRITICAL).** `InstalledSkill.source_sha` deserialized from `.skills.toml` (committed,

## Summary Mise processes `.tool-versions` files through the Tera template engine during parsing, with the `exec()` function registered, enabling arbitrary command execution. Unlike `.mise.toml` files, `.tool-versions` files are **not subject to trust verification** in non-paranoid mode. This means an attacker can place a malicious `.tool-versions` file in a git repository, and when a victim with

An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators. Such a query — for example `RETURN 1 + 1 + 1 + ...` with tens of thousands of terms — is parsed into an expression tree one level deep per operator. Because the chain is flat and the pratt parser appends to it iteratively, the configured query- and object-recursion limits never fire, so

A record user could read field values hidden from them by field-level SELECT permissions by reaching the records through a graph-edge (`->`) or back-reference (`(SELECT * FROM knows)`, `person:bobknows->(SELECT * FROM person)` — returned it intact. The root cause: the shared `resolve_record_batch` helper used by `GraphEdgeScan` (`FullEdge`) and `ReferenceScan` (`FullRecord`) enforced only the tab

A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR select WHERE owner = $auth.id`). When that field is indexed, a record user who cannot read it could still recover the relative ordering of its values across every record by issuing `ORDER BY `: the field came back `null` as intended, but the rows were returned in the hidden values'

SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (`DEFINE ANALYZER ... FILTERS mapper('')`). A database user with the `EDITOR` or `OWNER` role could point that filter at any file the SurrealDB process can read and have its content returned in the query's error message. File access is meant to be restricted by the `SURREAL_FILE_

SurrealDB fetches the JWKS document for a JWT or record access method using a bare `reqwest` client that follows HTTP redirects by default. The network capability check in `core/src/iam/jwks.rs` (`check_capabilities_url`) is applied only to the originally configured URL; redirect targets are not re-validated. An `--allow-net`-permitted JWKS host that returns a `3xx Location` can therefore redirect

### Impact Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The `quiche_connection_id_iter_next` and `quiche_conn_retired_scid_next` functions would return a pointer to a `ConnectionId` to the applications via function arguments, but the the owned `ConnectionId` would be dropped at the end of those functions' scope. Only application

## Summary A Deno program that opens a client `WebSocket` connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the `Sec-WebSocket-Protocol` and `Sec-WebSocket-Extensions` response headers in a way that assumed their bytes were always printable ASCII. A response header containing non-visible-ASCII bytes (`0x80`-`0xFF`) caused a panic that a

`PyCFunction::new_closure` (and the temporary `new_closure_bound` complement in the 0.21–0.22 series) required the supplied closure to be `Send + 'static` but not `Sync`. The resulting `PyCFunction` is a Python callable that can be invoked from any Python thread, which means the closure may be called concurrently from multiple threads, and needs a `Sync` bound to prevent possible data races. The

PyO3 0.24.0 added optimized implementations of `Iterator::nth` and `DoubleEndedIterator::nth_back` for the `BoundListIterator` and `BoundTupleIterator` types. These implementations computed the target index using unchecked `usize` addition (`index + n`) before bounds-checking against the sequence length, then read the element via `get_item_unchecked`. In `nth` methods, a sufficiently large `n` (c

# SSH message fields were decoded through allocation-first parsers before field-specific bounds ### Summary Several `russh` client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the librar

### Summary `russh` did not enforce the SSH identification-string rules as deliberately as OpenSSH. In particular, the server-side identification reader used the same permissive path as the client, allowing pre-banner lines from clients, and the reader did not enforce a bounded number of pre-banner lines. For a library server built on `russh`, this could allow a remote peer to hold connection se

### Summary In the `russh` client keyboard-interactive authentication path, a malicious SSH server could send a `USERAUTH_INFO_REQUEST` with an attacker-controlled prompt count, and the client would use that raw count directly in `Vec::with_capacity(...)` before validating that enough prompt data was actually present in the packet. This is a client-side denial-of-service / resource-exhaustion iss

## Impact `skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attacker to: 1. **Exfiltrate arbitrary files on the operator's machine** by publishing a malicious skills library containing a symlink inside a skill folder (e.g. `niania → /home/user/.aws/credentials`). The symlink fell through `entry.file_type().is_dir()` in `fs_util::copy_dir_all`,

## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the linker joins it onto the install prefix and writes an executable Python script. A malicious `noarch:python` package can ship an `info/link.json` with an entry-point name containing `..`, `/`, `\`, or an absolute path; the resulting file is written outside the prefix (or clobbers an

### Summary The `russh` server authentication path keeps internal userauth state across `SSH_MSG_USERAUTH_REQUEST` messages without separating that state when the request principal changes. RFC 4252 allows the `user name` and `service name` fields to change between authentication requests. The issue is not that such changes are invalid. The issue is that russh-owned authentication state, such as

### Summary When SSH compression is enabled, `russh` accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this is a remote denial-of-service / resource-exhaustion issue in the post-deco

### Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under `console_scripts` or `gui_scripts`), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory. A malicious wheel could use this to place an executable outside of the intended env

### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`. [Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities

### Impact Versions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem. ### Details When a tar stream contains multiple "header"

## Summary `Sender::send` in `src/lib.rs` contains an `unsafe` block in the `DISCONNECTED` arm that transmutes a **raw pointer** (`*mut Producer`) into the bytes of a **value-level** `Consumer`. The author's intent, visible in the surrounding comment at lines 386-390, was a value transmute. The shipped code is one level of indirection off. The resulting `Consumer` has its internal `Arc::ptr` set

## Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was neve

该论文聚焦于Linux内核扩展程序eBPF的安全迁移问题。eBPF程序被广泛用于网络、可观测性及安全策略执行，但其内核验证器仅检查低级内存安全和终止性，未强制许多高级源级属性，如初始化规则、schema一致性或错误处理。作者识别出六类源级bug，这些bug能够通过编译和内核验证，但会导致数据静默损坏、将先前跟踪的事件泄露至用户空间，或产生错误的执行结果。其中，作者发现了十款开源eBPF程序中此前未报道的信息泄露：这些程序中的环形缓冲区或栈驻留事件记录会将完全可解码的先前跟踪事件（包括用户标识路径和足以恢复每个事件KASLR偏移的内核返回地址）泄露到用户空间。为加固这些被验证器接受的缺陷程序并支持安全迁移，作者提出了Heimdall——一个自动化流水线，利用大语言模型（LLM）将遗留的libbpf C程序翻译为基于Aya Rust的eBPF程序。Heimdall迭代修复编译和内核验证失败，通过静态分析安全引擎拒绝Rust-Aya中不安全的逃逸机制，并借助符号执行和Z3等价性检查逐程序证明翻译后程序与原始程序行为等价。在102个eBPF程序上的实验表明，Heimdall成功生成了96个经形式化验证等价（94.1%）的翻译版本。Heimdall是首个能够自动化地将生产级eBPF程序迁移到内存安全语言，并为每个翻译程序提供形式化保证保持可观测行为的系统。

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in OCI images, Boxlite does not account for the possibility that entries may be symlinks pointing to absolute paths. An attacker can craft

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. One of the core security features claimed by Boxlite is the ability to mount host directories in read-only mode (read_only=True) into the VM via the virtiofs protocol (a host-guest shared filesystem protocol designed specifically

### Impact A maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the `.onetoc2` and joins them against the notebook's base directory without validating that they are relative paths confined to that directory. The parser will bail out when

### Title Unchecked `CryptoVec` allocation and growth handling was reachable from local agent inputs in current `russh` releases and from remote SSH traffic in historical pre-`0.58.0` releases ### Summary `CryptoVec` used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current `russh` releases, local SSH agent peers could still feed attacker-control

### Impact - **Key**: `challenger/src/multi_field_challenger.rs` | `MultiField32Challenger::duplexing` | `transcript_malleability` - **Affected files**: `challenger/src/multi_field_challenger.rs`, `field/src/helpers.rs` - **Violated invariant**: The Fiat-Shamir sponge must bind challenges to the exact sequence of observed field elements. Specifically: (1) absorption must be injective — distinct o

RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatically loads `.rtk/filters.toml` from the working directory with highest priority and without user notification. An attacker can place a malicious filter file in a repository to apply regex-based modifications (e.g., `strip_lines_matching`) to shell command output before it is shown

`CipherCtxRef::cipher_update_inplace` incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This only impacts users using AES key-wrap-

Diesel allows users to configure various options for PostgreSQL's `COPY FROM` and `COPY TO` statements. These configurations are partially provided as strings or characters. Diesel did not check if any these user-provided options contain a quote character `'`, which can lead to the injection of additional options in the current `COPY FROM`/`COPY TO` statement. This vulnerability affects any us

Diesel allows to register custom aggregate SQL functions for SQLite via the `SqliteAggregate` interface. To store an instance of the custom aggregate processor Diesel relied on the `sqlite3_aggregate_context` function provided by sqlite. This function doesn't provide any guarantees about alignment of the returned allocation, which in turn can lead to problems if the type implementing requires a s

Rust 作为一种系统级编程语言，通过强大的类型系统和所有权模型在编译时保证内存安全，但实际应用中仍然存在运行时崩溃和内存安全错误，可能导致可利用漏洞。现有静态分析工具在检测 Rust 程序中的缺陷时存在精度或覆盖面的不足。本文提出 MirChecker，一种基于 Rust 中间表示 MIR 的静态分析框架，通过模拟抽象解释和自定义检查器来检测多种类型的缺陷，包括空指针解引用、整数溢出、数组越界等。该方法在多个 Rust 开源项目（如 Rust 标准库、Servo、Tock 等）上进行了评估，结果表明 MirChecker 能够发现现有工具（如 Clippy、Rustc 自身警告）无法检测到的真实错误，同时具有较低的误报率。主要贡献包括：（1）设计并实现了一个针对 MIR 的静态分析引擎，支持路径敏感分析；（2）提出多种检查器覆盖常见缺陷模式；（3）在真实项目中发现多个新的 bug 并得到开发者确认。该工作适合 Rust 开发者、安全研究人员以及编译器工程人员阅读，有助于改进 Rust 生态系统的安全性。

## Summary dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive `rmcp` dependency, plus a related cross-origin CSRF gap. A malicious web page could make the user's browser send requests to a local `dynoxide mcp --http` or `dynoxide serve --mcp` server with a non-loopback `Host` header, which the server would then process. Affects 0.9.3 to 0.9.12. The stdio transport (`

`InlineVec::clear()` and `SerVec::clear()` in `rkyv` were not panic-safe. Both functions iterate over their elements and call `drop_in_place` on each, updating `self.len` only *after* the loop. If an element's `Drop` implementation panics during the loop, `self.len` is left at its original value. A subsequent invocation of `clear()` on the same container then re-visits the already-freed elements:

### Impact A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a `TaggedSigned` with a signature field whose byte length is not exactly 64. When the victim node's DHT verifier calls `TaggedSigned::verify`, execution reaches `Ed25519Signature::from_bytes(sig).unwrap()` in the `TaggedPublicKey` implementation for `Ed25519PublicKey`. The `from

### Summary The `task_create` tool spawns durable sub-agents that inherit two insecure defaults: - `allow_shell` defaults to `true` (`config.rs:1499`: `self.allow_shell.unwrap_or(true)`) - `auto_approve` defaults to `true` (`task_manager.rs:297`: `auto_approve: Some(true)`) When a user approves a `task_create` call (which requires `ApprovalRequirement::Required`), they approve what appears to b

### Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as `http://[::1]`, the SSRF defenses do not work. ### Details https://github.com/Hmbown/DeepSeek-TUI/blob/15f62e3e93d842f30b428877819ebc1c8cb96814/crates/tui/src/tools/fetch_url.rs#L321 ### PoC Prompt:‌ `Run fetch_url tool and give output, no thinking. Use url : http

### Summary The `run_tests` tool executes `cargo test` in the workspace with `ApprovalRequirement::Auto`, meaning it runs without any user approval prompt. The source code explicitly states this design choice: ```rust fn approval_requirement(&self) -> ApprovalRequirement { // Tests are encouraged, so avoid gating them behind approval. ApprovalRequirement::Auto } ``` `cargo test` compiles

### Summary The `fetch_url` tool validates the initial URL's resolved IP address against a restricted-IP blocklist (`is_restricted_ip()`) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (`reqwest`) is configured to automatically follow up to 5 redirects (`reqwest::redirect::Policy::limited(5)`) without re-validatin

### Impact Any uses of `InterfaceAccount` allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type. The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details. ### Patches https://github.com/solana-foundation/anchor/pull/4139

### Summary An logic error causes anchor programs to accept any program id when requiring the system program id, causing false assumptions resulting in potential arbitrary cpi in programs that invoke system program instructions. ### Details In the TryFrom> implementation for Program, the id of T is compared with Pubkey::default() to check whether anchor should allow any executable account, or a s

### Summary An integer overflow in the internal capacity calculation of `smallbitvec` can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring `unsafe` code from the caller. ### Details The issue originates from unchecked arithmetic in the internal helper function responsible for computing the required b

## Summary A composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on a targeted node. The attack exploits three independent weaknesses in the gossip, syncer, and download subsystems — all exercisable from a single TCP connection — to create a monotonically growing block deficit that neve

`CipherCtxRef::cipher_update`, `CipherCtxRef::cipher_update_vec`, and `symm::Crypter::update` incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (`EVP_aes_{128,192,256}_wrap_pad`). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacke

# `Zebra` Transparent `SIGHASH_SINGLE` Corresponding-Output Handling Diverges From `zcashd` ### Summary For V5+ transparent spends, `Zebra` and `zcashd` disagree on the same consensus rule: `SIGHASH_SINGLE` must fail when the input index has no corresponding output. `zcashd` treats this as consensus-invalid under ZIP-244, while `Zebra`'s transparent verification path computes a digest for the mis

# CVE-2026-44497: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer ## Summary The fix for https://github.com/ZcashFoundation/zebra/security/advisories/GHSA-8m29-fpq5-89jj introduced a separate issue due to insuficient error handling of the case where the sighash type is invalid, during sighash computation. Instead of returning an error, the normal flow would res

# CVE-2026-44500: Allocation Amplification in Inbound Network Deserializers ## Summary Several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus limits were enforced. An unauthenticated or post-handshake peer could therefore force the node to preallocate and parse for orders of magnitude more d

Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit (`MAX_BLOCK_SIGOPS`), allowing it to accept blocks that `zcashd` rejects with `bad-blk-sigops`. A miner who produces such a block can split the network: Zebra nodes follow the offending chain while `zcashd` nodes do not. Two distinct undercounts: #### A: Coinbase Hidden Legacy Sigops `zcashd

A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total size against the product of individual dimensions. This would erroneously cast *after* the multiplication and consequently fail to detect possible violations when overflow occurs. Afterwards, the individual sizes were trusted to properly constrain coordinates within the matrix to i

A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This checked considered `NaN` cases improperly, causing them to succeed the check instead of failing it. The floating point coordinate is under caller control by passing a selected projection matrix. Carefully controlling the coordinates of an image with no data and one non-zero dime

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by adding a constant to an input and taking the minimum of the resulting coordinate and 'dimension - 1'. This would not protect against malicious inputs that could overflow the addition. Following the tricked bounds check, the image could then be sampled at multiple differently calcu

During message encoding, `hickory-proto`'s `BinEncoder` stores pointers to labels that are candidates for name compression in a `Vec)>`. The name compression logic then searches for matches with a linear scan. A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks. This is similar to [

The NSEC3 closest-encloser proof validation in `hickory-proto`'s (0.25.0-alpha.3 ... 0.25.2) and `hickory-net`'s (0.26.0-alpha.1 .. 0.26.0) `DnssecDnsHandle` walks from the QNAME up to the SOA owner name, building a list of candidate encloser names. The iterator used assumes the QNAME is a descendant of the SOA owner, terminating only when the current candidate equals the SOA name. When the SOA i

### Impact When deserializing arrays, strings or bytes (blob) types zserio first reads the size of the variable, and then allocates sufficient memory to load data. Since the size is always trusted this can be abused by creating a data file with a large size value, causing the zserio runtime to allocate large amounts of memory. ### Patches Please cherry-pick [57f5fb](https://github.com/Danaozhon

### Impact Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus panic, when a table with an extremely large size is allocated. This is possible with the WebAssembly memory64 proposal where tables can have sizes in the 64-bit range as opposed to the previous 32-bit range which would not overflow.

### Summary diesel-async exposes uninitialized stack padding to safe code on every read of a MySQL `DATE`, `TIME`, `DATETIME`, or `TIMESTAMP` column. Reading that buffer is undefined behavior, and the leaked bytes can contain stale heap/stack contents, so this is both a soundness bug and a potential information-disclosure vector. ### Details In `diesel-async/src/mysql/row.rs` (lines 65-103), `M

### Summary A malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has write access to. ### Details During checkout, all symlink index entries are deferred and created after regular files using a single shared `gix_worktree::Stack`. Internally, this uses a `gix_fs::Stack`. `gix_fs::Stack:

## Summary The unauthenticated resend-verification endpoint returns different responses for registered and unregistered email addresses. A malicious third party can submit candidate addresses to `/api/v4/account/auth/resend_verification_email` and distinguish accounts from misses. ## Details `resend_verification_email()` looks up the submitted address and returns the lookup error to the caller:

### Impact LDAP queries are not validated for depth, which can cause the parser (both PEG and ASN) to exhaust the stack. This *may* cause a denial of service in applications that process queries. ### Workarounds N/A ### Resources Related to GHSA-r5fr-9gmv-jggh

### Summary The `POST /v1/domain/_image` and `POST /v1/oauth2/{rs_name}/_image` handlers call `validate_image()` on the uploaded body **before** the ACL check that restricts image upload to admins. Any bug in an image validator is therefore reachable by an unauthenticated remote client rather than being admin-gated. One such bug exists today: `png_has_trailer()` panics on inputs shorter than 8 by

### Summary A single unauthenticated `GET` to any `/scim/v1/...` endpoint with a `?filter=` query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with `std::process::abort()` — the entire `kanidmd` process exits. The parse runs inside axum's `Query` extractor, before any hand

### Summary The kanidmd OAuth2 token-exchange (`/oauth2/token`) and token-introspection (`/oauth2/token/introspect`) endpoints compare the supplied `client_secret` against the stored secret using Rust's `PartialEq` on `String`, which short-circuits on the first mismatching byte. This produces an observable timing discrepancy that varies with the length of the matching prefix. ### Details - http

### Summary The kanidmd web UI renders the WebAuthn passkey-registration challenge as raw JSON inside an inline `` element using the Askama `|safe` filter. The challenge embeds the account's `displayname`, which `serde_json` serialises without escaping ``. A `displayname` containing `` therefore terminates the script element early and injects arbitrary HTML into the credential-update page. Becaus

### Summary `webauthn-rs-core` ([Relying Party][rp]) and `webauthn-authenticator-rs` ([client][]) checked that [an `Origin` in `CollectedClientData`][origin] is valid for [an RP ID][rpid] with [`str::ends_with()`][ends-with], [without checking for a dot (`.`) before the RP ID when allowing subdomains][registerable-suffix]. This check is flawed, and could allow requests from an attacker-controlle

`X509Ref::ocsp_responders` returns OCSP responder URLs from a certificate's AIA extension as `OpensslString`, whose `Deref` wraps the raw bytes with `str::from_utf8_unchecked`. OpenSSL does not enforce that the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes safe Rust code to construct a `&str` that violates the UTF-8 invariant — resulting in

## Summary `ListServiceAccount` (`GET /rustfs/admin/v3/list-service-accounts?user=`) authorizes cross-user requests against `UpdateServiceAccountAdminAction` instead of `ListServiceAccountsAdminAction` at `rustfs/src/admin/handlers/service_account.rs:936`. The handler accepts the **wrong** admin action and rejects the **correct** one: - A user granted only `admin:UpdateServiceAccount` enumerates

## **Summary** attachments: [pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip) Submodule names coming from `.gitmodules` are exposed as unvalidated names and are later reused to derive the submodule git directory as: ``` /modules/ ``` Because the submodule name is joined directly as a filesystem path component, a name such as `../../../escaped-target.git` escapes `.git/modu

## Summary attachments: [pocs.zip](https://github.com/user-attachments/files/26431422/pocs.zip) When `Repository::submodules()` loads submodule metadata, it prefers the worktree `.gitmodules` file if that path exists. In the current implementation, the path is read with `std::fs::read()`, which follows symlinks. As a result, a repository can present a symlinked `.gitmodules` that points outside

形式化验证是确保软件正确性和安全性的最高保证，但将其应用于大规模、不断演变的系统仍面临重大挑战。尽管大语言模型（LLM）在自动证明生成方面展现出潜力，但由于无法处理复杂的跨模块依赖关系或代码库及验证工具链的变化，它们在实际应用中常常失败。本文识别出根本问题在于语义-结构鸿沟：LLM基于语义代码模式进行操作，而形式化验证受刚性结构依赖约束，这种脱节导致脆弱且不可持续的证明。为弥合这一鸿沟，作者提出了一种自适应性验证的新范式，并实现了KVerus——一个面向基于Verus的Rust验证的检索增强系统，能够适应不断演变的软件环境。KVerus构建了包含代码元数据、引理语义和工具链细节的动态知识库，通过结合依赖感知的程序分析、语义引理索引和错误驱动的自我精化，它能够导航复杂的跨文件依赖来合成证明，并在面对常见的演化变化时自动修复证明。在三个单文件基准测试中，KVerus验证了80.2%的任务，优于当前最先进的AutoVerus（56.9%），并且在破坏性的Verus更新下退化更少。在三个具有跨文件依赖的仓库级基准测试中，KVerus实现了51.0%的成功率，而多轮提示基线仅为4.5%。最后，在Asterinas Rust操作系统内核中，KVerus生成了被上游接受的证明，验证了内存管理模块中23个先前未验证的函数（占证明代码的21.0%）。KVerus标志着向使现代安全关键软件的形式化验证成为可扩展且可持续实践迈出的重要一步。

Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy is expensive and a project's policy rarely changes, `sq-git` has an optimization to only check a policy if it hasn't checked it before. It does this by maintaining a set of policies that it had already seen keyed on the policy's hash. Unfortunately, due to a bug the hash was tr

`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

`sui-execution-cut` included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io.

# Summary The Hickory DNS project's experimental `hickory-recursor` crate's record cache (`DnsLru`) stores records from DNS responses keyed by each record's own (name, type), not by the query that triggered the response. `cache_response()` in `crates/recursor/src/lib.rs` chains `ANSWER`, `AUTHORITY`, and `ADDITIONAL` sections into one record iterator before insertion. The bailiwick filter it appl