Beyond Single-Vulnerability Evaluation: Closing the Engineering Decision Gap Between C Retrofits and Native Safety

本文针对C语言内存安全加固研究中普遍存在的“单漏洞类孤立评估”问题，提出了一种全新的跨语言比较评估范式。过去数十年，研究者提出了许多针对C语言的内存安全回填机制，但这些机制几乎总是在孤立条件下、针对特定漏洞类型进行评估，导致实际工程实践中难

历史摘要 · 未重新核验 · arXiv cs.CR

s2n-quic has excessive memory allocation

CVE-2026-10740

s2n-quic is a Rust implementation of the QUIC protocol. An unauthenticated user can attempt to exhaust server memory on

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

A `SELECT` permission defined on an array element (`DEFINE FIELD field.* … PERMISSIONS FOR select …`) is not enforced co

历史摘要 · 未重新核验 · GitHub Advisory

Oxidizer: Toward Concise and High-fidelity Rust Decompilation.

本论文（arXiv 论文，标题为《Oxidizer: Toward Concise and High-fidelity Rust Decompilation》）提出了一款名为 Oxidizer 的 Rust 反编译工具或框架，旨在解决 Ru

历史摘要 · 未重新核验 · IEEE S&P

nimiq-blockchain: Validity store off by one error

CVE-2026-46369

### Impact The validity store treats a transaction with stored `block_number = X` as "in window" only when `X > last_bn

历史摘要 · 未重新核验 · GitHub Advisory

Sound Enforcement of Dynamic Release Information Flow Policy-Full Version

本文研究信息流分析（Information Flow Analysis）在真实系统中的应用问题。信息流分析是评估机密性和完整性的主要方法，但实际采用率不高，根本原因在于理论与实践的差距：现有技术通常假设安全策略是静态的（即数据保密性不变），

历史摘要 · 未重新核验 · arXiv cs.CR

deepSURF: Detecting Memory Safety Vulnerabilities in Rust Through Fuzzing LLM-Augmented Harnesses.

本文提出 deepSURF，一种结合静态分析与大语言模型（LLM）引导的模糊测试工具，用于检测 Rust 库中的内存安全漏洞，尤其针对 unsafe 代码。尽管 Rust 默认保证内存安全，但 unsafe 代码的使用可能引入安全漏洞。现有

历史摘要 · 未重新核验 · IEEE S&P

RustGo: Fairly Directed Greybox Fuzzing for Enforcing Rust Memory Safety

Rust作为一种系统编程语言，以其强内存安全性和低性能开销而闻名。通过所有权、借用等严格安全策略，Rust编译器能够保证大部分代码的内存安全。然而，在unsafe代码块中，这些安全策略并未完全启用，导致内存错误仍可能发生。尽管这类unsaf

历史摘要 · 未重新核验 · arXiv cs.CR

Russh: Channel-scoped server callbacks can be reached without an open channel

CVE-2026-68930

There is a server-side channel state issue in `russh`. After a client is authenticated, `russh` can dispatch channel-sc

历史摘要 · 未重新核验 · GitHub Advisory

zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit

### Summary `NonFinalizedState::handle_reorg` is a recursive, unbounded async function that traverses parent blocks unti

历史摘要 · 未重新核验 · GitHub Advisory

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

### Impact `skilo add` installs a skill by recursively copying the skill directory into the target skills directory. Th

历史摘要 · 未重新核验 · GitHub Advisory

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

CVE-2026-16756

## Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations s

历史摘要 · 未重新核验 · GitHub Advisory

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the init

历史摘要 · 未重新核验 · GitHub Advisory

HarnessLLM: Rust Verification Harness Generation with Large Language Models

Rust语言的所有权模型和类型系统提供了强大的内存安全保障，但unsafe代码和运行时panic依然带来显著风险。形式化验证是确保内存安全的关键，然而开发验证harness（验证框架）是一项具有挑战性的手动任务。虽然大语言模型在各类代码分析

历史摘要 · 未重新核验 · arXiv cs.CR

KaPilot: LLM-Assisted Generation of Kani Specifications for Unsafe Rust Verification

该论文提出了 KaPilot，一个基于大语言模型（LLM）的多智能体框架，用于自动生成 Rust 语言中 unsafe 代码内存安全的形式化规约（specifications），以支持使用 Kani 验证器进行形式化验证。Rust 的所有权

历史摘要 · 未重新核验 · arXiv cs.CR

Prompty: Arbitrary file read via file reference expansion

CVE-2026-53598

## Summary Prompty loaders expanded `${file:...}` references in `.prompty` frontmatter without enforcing that the resolv

历史摘要 · 未重新核验 · GitHub Advisory

Vest: Verified, Secure, High-Performance Parsing and Serialization for Rust.

本论文针对 Rust 语言中解析和序列化操作的安全性与性能挑战，提出了一种名为 Vest 的新型框架。Rust 以其内存安全著称，但手写解析器和序列化器仍然容易出错且效率低下。现有方案（如 serde）虽提供自动化，但缺乏形式化验证，且难以

历史摘要 · 未重新核验 · USENIX Security

nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

CVE-2026-54542

### Impact A malicious peer acting as a state-sync source can crash a syncing node with a crafted `TrieChunk` whose pro

历史摘要 · 未重新核验 · GitHub Advisory