# Vulnerabilities published in 2025


- [RUSTSEC-2025-0171](https://insights.sbomify.com/RUSTSEC-2025-0171/): soundness issue (not scored)
- [RUSTSEC-2025-0170](https://insights.sbomify.com/RUSTSEC-2025-0170/): `hugepage_rs::dealloc` may allow invalid memory deallocation from safe code (not scored)
- [RUSTSEC-2025-0169](https://insights.sbomify.com/RUSTSEC-2025-0169/): `FormatContext` stream accessors can cause undefined behavior from safe code (not scored)
- [RUSTSEC-2025-0167](https://insights.sbomify.com/RUSTSEC-2025-0167/): `Bitmap::try_from(&[u8])` can create invalid values (not scored)
- [RUSTSEC-2025-0166](https://insights.sbomify.com/RUSTSEC-2025-0166/): Multiple soundness issues in `stackvector` (not scored)
- [RUSTSEC-2025-0165](https://insights.sbomify.com/RUSTSEC-2025-0165/): i_tree allowed out-of-bounds access through safe public node accessors (not scored)
- [RUSTSEC-2025-0164](https://insights.sbomify.com/RUSTSEC-2025-0164/): `DTriangle` accessors may read out of bounds in affected versions (not scored)
- [RUSTSEC-2025-0162](https://insights.sbomify.com/RUSTSEC-2025-0162/): `VMABuffer::set_data` may allow out-of-bounds writes from safe code (not scored)
- [RUSTSEC-2025-0161](https://insights.sbomify.com/RUSTSEC-2025-0161/): libsecp256k1 is unmaintained (not scored)
- [RUSTSEC-2025-0160](https://insights.sbomify.com/RUSTSEC-2025-0160/): `custom-req-on-workers` was removed from crates.io for malicious code (not scored)
- [RUSTSEC-2025-0159](https://insights.sbomify.com/RUSTSEC-2025-0159/): `sophosfirewall-python` was removed from crates.io for malicious code (not scored)
- [RUSTSEC-2025-0158](https://insights.sbomify.com/RUSTSEC-2025-0158/): `jfrog_quotes` was removed from crates.io for malicious code (not scored)
- [RUSTSEC-2025-0157](https://insights.sbomify.com/RUSTSEC-2025-0157/): `statsrelay-protobuf` was removed from crates.io for malicious code (not scored)
- [RUSTSEC-2025-0156](https://insights.sbomify.com/RUSTSEC-2025-0156/): `tree-sitter-pkl` was removed from crates.io for malicious code (not scored)
- [RUSTSEC-2025-0155](https://insights.sbomify.com/RUSTSEC-2025-0155/): `rands` was removed from crates.io for malicious code (not scored)
- [RUSTSEC-2025-0141](https://insights.sbomify.com/RUSTSEC-2025-0141/): Bincode is unmaintained (not scored)
- [RUSTSEC-2025-0134](https://insights.sbomify.com/RUSTSEC-2025-0134/): rustls-pemfile is unmaintained (not scored)
- [RUSTSEC-2025-0124](https://insights.sbomify.com/RUSTSEC-2025-0124/): rand_os crate is unmaintained (not scored)
- [RUSTSEC-2025-0123](https://insights.sbomify.com/RUSTSEC-2025-0123/): opentelemetry-jaeger crate is unmaintained (not scored)
- [RUSTSEC-2025-0122](https://insights.sbomify.com/RUSTSEC-2025-0122/): cargo-asm crate is unmaintained (not scored)
- [RUSTSEC-2025-0121](https://insights.sbomify.com/RUSTSEC-2025-0121/): gcc crate is unmaintained (not scored)
- [RUSTSEC-2025-0119](https://insights.sbomify.com/RUSTSEC-2025-0119/): number_prefix crate is unmaintained (not scored)
- [RUSTSEC-2025-0117](https://insights.sbomify.com/RUSTSEC-2025-0117/): tandem is unmaintained (not scored)
- [RUSTSEC-2025-0116](https://insights.sbomify.com/RUSTSEC-2025-0116/): tandem_garble_interop is unmaintained (not scored)
- [RUSTSEC-2025-0115](https://insights.sbomify.com/RUSTSEC-2025-0115/): tandem_http_server is unmaintained (not scored)
- [RUSTSEC-2025-0114](https://insights.sbomify.com/RUSTSEC-2025-0114/): tandem_http_client is unmaintained (not scored)
- [RUSTSEC-2025-0104](https://insights.sbomify.com/RUSTSEC-2025-0104/): `unic-ucd-segment` is unmaintained (not scored)
- [RUSTSEC-2025-0103](https://insights.sbomify.com/RUSTSEC-2025-0103/): `unic-ucd-core` is unmaintained (not scored)
- [RUSTSEC-2025-0102](https://insights.sbomify.com/RUSTSEC-2025-0102/): `unic-ucd-age` is unmaintained (not scored)
- [RUSTSEC-2025-0101](https://insights.sbomify.com/RUSTSEC-2025-0101/): `unic-ucd-common` is unmaintained (not scored)
- [RUSTSEC-2025-0100](https://insights.sbomify.com/RUSTSEC-2025-0100/): `unic-ucd-ident` is unmaintained (not scored)
- [RUSTSEC-2025-0099](https://insights.sbomify.com/RUSTSEC-2025-0099/): `unic-ucd-block` is unmaintained (not scored)
- [RUSTSEC-2025-0098](https://insights.sbomify.com/RUSTSEC-2025-0098/): `unic-ucd-version` is unmaintained (not scored)
- [RUSTSEC-2025-0097](https://insights.sbomify.com/RUSTSEC-2025-0097/): `unic-idna-mapping` is unmaintained (not scored)
- [RUSTSEC-2025-0096](https://insights.sbomify.com/RUSTSEC-2025-0096/): `unic-bidi` is unmaintained (not scored)
- [RUSTSEC-2025-0095](https://insights.sbomify.com/RUSTSEC-2025-0095/): `unic` is unmaintained (not scored)
- [RUSTSEC-2025-0094](https://insights.sbomify.com/RUSTSEC-2025-0094/): `unic-ucd-category` is unmaintained (not scored)
- [RUSTSEC-2025-0093](https://insights.sbomify.com/RUSTSEC-2025-0093/): `unic-char-basics` is unmaintained (not scored)
- [RUSTSEC-2025-0092](https://insights.sbomify.com/RUSTSEC-2025-0092/): `unic-ucd-case` is unmaintained (not scored)
- [RUSTSEC-2025-0091](https://insights.sbomify.com/RUSTSEC-2025-0091/): `unic-utils` is unmaintained (not scored)
- [RUSTSEC-2025-0090](https://insights.sbomify.com/RUSTSEC-2025-0090/): `unic-emoji-char` is unmaintained (not scored)
- [RUSTSEC-2025-0089](https://insights.sbomify.com/RUSTSEC-2025-0089/): `unic-ucd-name_aliases` is unmaintained (not scored)
- [RUSTSEC-2025-0088](https://insights.sbomify.com/RUSTSEC-2025-0088/): `unic-idna-punycode` is unmaintained (not scored)
- [RUSTSEC-2025-0087](https://insights.sbomify.com/RUSTSEC-2025-0087/): `unic-cli` is unmaintained (not scored)
- [RUSTSEC-2025-0086](https://insights.sbomify.com/RUSTSEC-2025-0086/): `unic-char` is unmaintained (not scored)
- [RUSTSEC-2025-0085](https://insights.sbomify.com/RUSTSEC-2025-0085/): `unic-idna` is unmaintained (not scored)
- [RUSTSEC-2025-0084](https://insights.sbomify.com/RUSTSEC-2025-0084/): `unic-emoji` is unmaintained (not scored)
- [RUSTSEC-2025-0083](https://insights.sbomify.com/RUSTSEC-2025-0083/): `unic-ucd-bidi` is unmaintained (not scored)
- [RUSTSEC-2025-0082](https://insights.sbomify.com/RUSTSEC-2025-0082/): `unic-normal` is unmaintained (not scored)
- [RUSTSEC-2025-0081](https://insights.sbomify.com/RUSTSEC-2025-0081/): `unic-char-property` is unmaintained (not scored)
- [RUSTSEC-2025-0080](https://insights.sbomify.com/RUSTSEC-2025-0080/): `unic-common` is unmaintained (not scored)
- [RUSTSEC-2025-0079](https://insights.sbomify.com/RUSTSEC-2025-0079/): `unic-ucd-hangul` is unmaintained (not scored)
- [RUSTSEC-2025-0078](https://insights.sbomify.com/RUSTSEC-2025-0078/): `unic-ucd-normal` is unmaintained (not scored)
- [RUSTSEC-2025-0077](https://insights.sbomify.com/RUSTSEC-2025-0077/): `unic-ucd` is unmaintained (not scored)
- [RUSTSEC-2025-0076](https://insights.sbomify.com/RUSTSEC-2025-0076/): `unic-ucd-name` is unmaintained (not scored)
- [RUSTSEC-2025-0075](https://insights.sbomify.com/RUSTSEC-2025-0075/): `unic-char-range` is unmaintained (not scored)
- [RUSTSEC-2025-0074](https://insights.sbomify.com/RUSTSEC-2025-0074/): `unic-segment` is unmaintained (not scored)
- [RUSTSEC-2025-0069](https://insights.sbomify.com/RUSTSEC-2025-0069/): `daemonize` is Unmaintained (not scored)
- [RUSTSEC-2025-0066](https://insights.sbomify.com/RUSTSEC-2025-0066/): The `google-apis-rs` project is now unmaintained (not scored)
- [RUSTSEC-2025-0064](https://insights.sbomify.com/RUSTSEC-2025-0064/): soundness issue and unmaintained (not scored)
- [RUSTSEC-2025-0061](https://insights.sbomify.com/RUSTSEC-2025-0061/): iron crate is unmaintained (not scored)
- [RUSTSEC-2025-0060](https://insights.sbomify.com/RUSTSEC-2025-0060/): crypto-hash crate is unmaintained (not scored)
- [RUSTSEC-2025-0059](https://insights.sbomify.com/RUSTSEC-2025-0059/): servo-fontconfig crate is unmaintained (not scored)
- [RUSTSEC-2025-0058](https://insights.sbomify.com/RUSTSEC-2025-0058/): custom_derive crate is unmaintained (not scored)
- [RUSTSEC-2025-0057](https://insights.sbomify.com/RUSTSEC-2025-0057/): fxhash - no longer maintained (not scored)
- [RUSTSEC-2025-0056](https://insights.sbomify.com/RUSTSEC-2025-0056/): adler crate is unmaintained, use adler2 instead (not scored)
- [RUSTSEC-2025-0052](https://insights.sbomify.com/RUSTSEC-2025-0052/): async-std has been discontinued (not scored)
- [RUSTSEC-2025-0048](https://insights.sbomify.com/RUSTSEC-2025-0048/): tsify-next is unmaintained, use tsify instead (not scored)
- [RUSTSEC-2025-0045](https://insights.sbomify.com/RUSTSEC-2025-0045/): ConstStaticCell could have been used to pass non-Send values to another thread (not scored)
- [RUSTSEC-2025-0036](https://insights.sbomify.com/RUSTSEC-2025-0036/): surf is unmaintained (not scored)
- [RUSTSEC-2025-0030](https://insights.sbomify.com/RUSTSEC-2025-0030/): totally-safe-transmute allows transmuting any type to any other type in safe Rust (not scored)
- [RUSTSEC-2025-0029](https://insights.sbomify.com/RUSTSEC-2025-0029/): totally-safe introduces memory vulnerabilities in safe Rust (not scored)
- [RUSTSEC-2025-0028](https://insights.sbomify.com/RUSTSEC-2025-0028/): cve-rs introduces memory vulnerabilities in safe Rust (not scored)
- [RUSTSEC-2025-0026](https://insights.sbomify.com/RUSTSEC-2025-0026/): registry is unmaintained (not scored)
- [RUSTSEC-2025-0025](https://insights.sbomify.com/RUSTSEC-2025-0025/): rustc-serialize is unmaintained (not scored)
- [RUSTSEC-2025-0017](https://insights.sbomify.com/RUSTSEC-2025-0017/): The `trust-dns` project has been rebranded to `hickory-dns` (not scored)
- [RUSTSEC-2025-0013](https://insights.sbomify.com/RUSTSEC-2025-0013/): resolve is unmaintained (not scored)
- [RUSTSEC-2025-0012](https://insights.sbomify.com/RUSTSEC-2025-0012/): `backoff` is unmaintained. (not scored)
- [RUSTSEC-2025-0011](https://insights.sbomify.com/RUSTSEC-2025-0011/): `openpgp-card-sequoia` is unmaintained. (not scored)
- [RUSTSEC-2025-0010](https://insights.sbomify.com/RUSTSEC-2025-0010/): Versions of *ring* prior to 0.17 are unmaintained. (not scored)
- [PYSEC-2025-8](https://insights.sbomify.com/PYSEC-2025-8/): After the owner removed the project from PyPI, another user uploaded a new version with non-working code (not scored)
- [PYSEC-2025-7](https://insights.sbomify.com/PYSEC-2025-7/): Posts scraped data to IP address associated with other malware distribution attacks. (not scored)
- [PYSEC-2025-6](https://insights.sbomify.com/PYSEC-2025-6/): Exfiltrates cookies to hardcoded IP address (not scored)
- [PYSEC-2025-5](https://insights.sbomify.com/PYSEC-2025-5/): Exfiltrates user cookies to hardcoded server endpoint during normal operations (not scored)
- [PYSEC-2025-4](https://insights.sbomify.com/PYSEC-2025-4/): When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server. (not scored)
- [PYSEC-2025-3](https://insights.sbomify.com/PYSEC-2025-3/): When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server. (not scored)
- [PYSEC-2025-2](https://insights.sbomify.com/PYSEC-2025-2/): uniapi version 1.0.7 contained an information harvesting script. (not scored)
- [OSV-2025-994](https://insights.sbomify.com/OSV-2025-994/): Heap-buffer-overflow in rx_icmp (not scored)
- [OSV-2025-989](https://insights.sbomify.com/OSV-2025-989/): Bad-cast to UT_hash_bucket' (aka 'struct UT_hash_bucket')password_file__cleanup (not scored)
- [OSV-2025-983](https://insights.sbomify.com/OSV-2025-983/): Dynamic-stack-buffer-overflow in _ox_err_set_with_location (not scored)
- [OSV-2025-970](https://insights.sbomify.com/OSV-2025-970/): Heap-buffer-overflow in check_sync_pes (not scored)
- [OSV-2025-965](https://insights.sbomify.com/OSV-2025-965/): Stack-use-after-scope in Assimp::FBX::FBXExportProperty::FBXExportProperty (not scored)
- [OSV-2025-959](https://insights.sbomify.com/OSV-2025-959/): Heap-buffer-overflow in re_parse_term (not scored)
- [OSV-2025-955](https://insights.sbomify.com/OSV-2025-955/): Use-of-uninitialized-value in decoder_context::construct_reference_picture_lists (not scored)
- [OSV-2025-938](https://insights.sbomify.com/OSV-2025-938/): Use-of-uninitialized-value in comp_func_SourceOver_avx2 (not scored)
- [OSV-2025-932](https://insights.sbomify.com/OSV-2025-932/): Heap-use-after-free in password_file__cleanup (not scored)
- [OSV-2025-93](https://insights.sbomify.com/OSV-2025-93/): Heap-buffer-overflow in lj_strfmt_pushvf (not scored)
- [OSV-2025-926](https://insights.sbomify.com/OSV-2025-926/): Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement (not scored)
- [OSV-2025-92](https://insights.sbomify.com/OSV-2025-92/): Null-dereference READ in session_startup (not scored)
- [OSV-2025-906](https://insights.sbomify.com/OSV-2025-906/): Use-of-uninitialized-value in QImage::pixel (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2025/page/2/