Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
OSV Rustsec π¦ is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| rustsec-2026-0364 | Exception tags can cause host data structures to be unaligned | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0363 | Component-model handle tables are capped only per instance and charged to no limit | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0362 | Wasmtime may not properly enforce async-entrypoint requirement | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0361 | Panic when pending calls are run after a trap | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0360 | Overlapping string transcode in a fused adapter can panic | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0359 | Stack overflow dropping a long chain of recursive types | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0358 | Yielding in a component start function can lead to a host panic | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0357 | Out-of-bounds zero-length stream writes can panic | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0356 | Panic on erroneous call-to-host from guest realloc call | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0355 | Panic viewing component model stream or future as the wrong type | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0354 | Host panic when component `call_async` is cancelled under some conditions | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0353 | Panic when invoking an async-lifted function via `call` | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0352 | Filesystem sandbox escape when renaming symlinks with trailing slashes | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0351 | `wasi-http`: Request with long url before query parameter crashes host | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0350 | Guests can send absolute-form HTTP requests to different hosts | 2026-10-14T12:00:00Z | 2026-10-14T20:18:32Z |
| rustsec-2026-0349 | Unauthenticated ServerHello can downgrade later connections to classical key exchange | 2026-10-14T12:00:00Z | 2026-10-14T13:17:45Z |
| rustsec-2026-0348 | Brotli certificate decompression can allocate up to 1 GiB before authentication | 2026-10-14T12:00:00Z | 2026-10-14T13:17:45Z |
| rustsec-2026-0347 | Buffered application data sent to outer server after ECH rejection | 2026-10-14T12:00:00Z | 2026-10-14T13:17:45Z |
| rustsec-2026-0346 | `Debug` impls for client session values expose TLS secrets | 2026-10-14T12:00:00Z | 2026-10-14T13:17:45Z |
| rustsec-2026-0344 | Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM) | 2026-10-11T12:00:00Z | 2026-10-13T10:39:39Z |
| rustsec-2026-0337 | Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more | 2026-10-09T12:00:00Z | 2026-10-12T18:05:20Z |
| rustsec-2026-0336 | MIKEY message MAC is never verified on receive, so forged messages are accepted | 2026-10-09T12:00:00Z | 2026-10-12T08:58:45Z |
| rustsec-2026-0335 | Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key | 2026-10-09T12:00:00Z | 2026-10-12T08:58:45Z |
| rustsec-2026-0333 | Resource budgets not enforced on the typed deserialization path | 2026-10-06T12:00:00Z | 2026-10-08T14:47:14Z |
| rustsec-2026-0327 | Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow | 2026-10-02T12:00:00Z | 2026-10-02T20:27:46Z |
| rustsec-2026-0326 | Rooting for GC values live across `try_call` may be missing, causing GC heap corruption | 2026-10-02T12:00:00Z | 2026-10-02T20:27:46Z |
| rustsec-2026-0325 | Mis-typed WebAssembly tag imports can lead to GC heap corruption | 2026-10-02T12:00:00Z | 2026-10-02T20:27:46Z |
| rustsec-2026-0324 | Guest can panic host through filesystem timestamp before the epoch on wasip3 | 2026-10-02T12:00:00Z | 2026-10-02T20:27:46Z |
| rustsec-2026-0323 | fd_readdir copies uninitialized struct padding into guest memory | 2026-10-02T12:00:00Z | 2026-10-02T20:27:46Z |
| rustsec-2026-0322 | Excessive allocated memory on the host when guests don't have stdio | 2026-10-02T12:00:00Z | 2026-10-02T20:27:46Z |