{"answers":{"affected":"1 open source package ship an affected version, including nostr.","exploited":"There is no known exploitation of RUSTSEC-2026-0228 in the wild and no public exploit code.","fix":"Upgrade nostr to 0.44.7 or later.","what":"RUSTSEC-2026-0228 is a denial of service vulnerability in nostr, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for RUSTSEC-2026-0228 and fix it if it is affected.\n\nWhat it is: RUSTSEC-2026-0228 is a denial of service vulnerability in nostr, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of RUSTSEC-2026-0228 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- nostr (crates.io): affected from 0.0.0-0; fixed in 0.44.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/RUSTSEC-2026-0228/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0228/index.md)","id":"RUSTSEC-2026-0228","markdown":"https://insights.sbomify.com/RUSTSEC-2026-0228/index.md","name":"RUSTSEC-2026-0228","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Rust NIP-04 library","requires_auth":"none","summary":"A malicious sender can cause memory exhaustion in Rust applications using this NIP-04 decryption library by sending malformed encrypted messages with excessive separators or oversized IVs.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The NIP-04 decryption parser split attacker-controlled content on every `?iv=`\nseparator and collected all resulting segments before checking that the message had\nthe expected two parts. It also Base64-decoded the complete IV text before checking\nthat it represented the required 16-byte AES-CBC IV.\n\nA malicious sender could include a large number of separators or an oversized IV in\nan encrypted direct message. Applications that attempted to decrypt the message\nperformed avoidable allocations proportional to the malformed input, with additional\nallocation amplification from the segment vector and Base64 output. This can consume\nmemory and CPU in clients processing messages received through a relay. It does not\nweaken NIP-04 encryption or reveal plaintext or key material.\n\nThe parser now uses a single bounded split, rejects additional separators, and\nvalidates the 24-byte encoded IV length before Base64 decoding. Malformed inputs are\nreturned as errors without allocating for every separator or decoding an arbitrarily\nlarge IV.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"NIP-04 parsing amplifies malformed ciphertext memory use","id":"RUSTSEC-2026-0228","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.44.7"],"introduced":["0.0.0-0"],"last_affected":[],"package":"nostr","purl":"pkg:cargo/nostr","source":"RUSTSEC-2026-0228"}],"products":null,"published":"2026-08-01","related":[],"sources":[{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A malicious sender can cause memory exhaustion in Rust applications using this NIP-04 decryption library by sending malformed encrypted messages with excessive separators or oversized IVs.","url":"https://insights.sbomify.com/RUSTSEC-2026-0228/"}