RUSTSEC-2025-0134 rustls-pemfile is unmaintained
The rustls-pemfile crate is unmaintained and archived, requiring users to migrate to rustls-pki-types for continued security support.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- None listed
What is RUSTSEC-2025-0134?
RUSTSEC-2025-0134 is a vulnerability in rustls-pemfile, published on 28 Nov 2025.
Official description
The rustls-pemfile crate is no longer maintained. The repository has been archived since August 2025, and users are encouraged to depend directly on the underlying PEM parsing code included in rustls-pki-types since 1.9.0. The latest version of rustls-pemfile is in fact a thin wrapper around the same code used in rustls-pki-types, so migrating should be straightforward.
The new API is represented by the PemObject trait, which provides methods for
reading a single or multiple PEM objects from a file or byte slice.
Which versions are affected by RUSTSEC-2025-0134?
1 open source package ship an affected version, including rustls-pemfile.
| Package | Affected | Fixed in |
|---|---|---|
rustls-pemfile crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2025-0134?
No fix has been published for RUSTSEC-2025-0134 yet. Limit exposure of the affected software until one is available.
Is RUSTSEC-2025-0134 being exploited?
There is no known exploitation of RUSTSEC-2025-0134 in the wild and no public exploit code.