Issues

• RUSTSEC-2026-0368: zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

  openprx/sylvode#30 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

  openprx/sylvode#29 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

  openprx/sylvode#28 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0354: Host panic when component call_async is cancelled under some conditions

  openprx/sylvode#27 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0355: Panic viewing component model stream or future as the wrong type

  openprx/sylvode#26 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0357: Out-of-bounds zero-length stream writes can panic

  openprx/sylvode#25 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0356: Panic on erroneous call-to-host from guest realloc call

  openprx/sylvode#24 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0363: Component-model handle tables are capped only per instance and charged to no limit

  openprx/sylvode#23 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0360: Overlapping string transcode in a fused adapter can panic

  openprx/sylvode#22 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0359: Stack overflow dropping a long chain of recursive types

  openprx/sylvode#21 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0353: Panic when invoking an async-lifted function via call

  openprx/sylvode#20 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0362: Wasmtime may not properly enforce async-entrypoint requirement

  openprx/sylvode#19 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0364: Exception tags can cause host data structures to be unaligned

  openprx/sylvode#18 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0361: Panic when pending calls are run after a trap

  openprx/sylvode#17 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0358: Yielding in a component start function can lead to a host panic

  openprx/sylvode#16 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets

  openprx/sylvode#15 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange

  openprx/sylvode#14 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication

  openprx/sylvode#13 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0347: Buffered application data sent to outer server after ECH rejection

  openprx/sylvode#12 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0338: Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

  openprx/sylvode#11 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0340: Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled

  openprx/sylvode#10 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0342: Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto

  openprx/sylvode#9 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0339: Unbounded growth of pending connection ID retirements in quinn-proto

  openprx/sylvode#8 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0341: Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

  openprx/sylvode#7 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0173: proc-macro-error2 is unmaintained

  openprx/sylvode#5 · Filter by author github-actions opened on Jun 8, 2026