Repository navigation
audit-schedule: known vulnerabilities on dev #1447
Description
Known advisories
Without a valid exception
- GHSA-587h-7wmj-h5pm: launch-editor:
fs.existsSync()existence check can be bypassed on Windows - RUSTSEC-2026-0346:
Debugimpls for client session values expose TLS secrets - RUSTSEC-2026-0347: Buffered application data sent to outer server after ECH rejection
- RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication
- RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange
- RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
- RUSTSEC-2026-0368: zip:
ZipArchive::extractcreates symbolic links whose attacker-controlled targets are outside the destination directory - RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
- RUSTSEC-2026-0381: Bundled root certificates allow trust in distrusted emSign intermediates
- RUSTSEC-2026-0382: Certificate verification may accept distrusted intermediates
- RUSTSEC-2026-0383: Bundled root certificates allow trust in distrusted emSign intermediates
- RUSTSEC-2026-0385: Non-constant-time mask generation and
u128comparisons - RUSTSEC-2026-0403: Uninitialized memory exposed when streaming decompression of a legacy frame fails
- RUSTSEC-2026-0410: WebAssembly allocator shim corrupts memory on allocation failure
Activity
MikolajKakol commentedon Oct 28, 2026
Fixed by #1467: dependencies bumped, the four advisories that remain in lockfiles only (RUSTSEC-2026-0367/0368/0369, RUSTSEC-2026-0403, via burn's unbuilt tch/candle backends) carry exceptions until 2027-01-28, tracked in SPEED-906. Manual audit-schedule run on dev 7baa06c is green.