# Vulnerabilities published in 2026


- [RUSTSEC-2026-0334](https://insights.sbomify.com/RUSTSEC-2026-0334/): BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses (not scored)
- [RUSTSEC-2026-0333](https://insights.sbomify.com/RUSTSEC-2026-0333/): Resource budgets not enforced on the typed deserialization path (not scored)
- [RUSTSEC-2026-0332](https://insights.sbomify.com/RUSTSEC-2026-0332/): `WaveFormat::parse` reads past the end of a `&WAVEFORMATEX` (not scored)
- [RUSTSEC-2026-0331](https://insights.sbomify.com/RUSTSEC-2026-0331/): Panic on Decoding Short Hybrid Keys (not scored)
- [RUSTSEC-2026-0330](https://insights.sbomify.com/RUSTSEC-2026-0330/): Hybrid Encapsulation from Seed Panics on Short Seed (not scored)
- [RUSTSEC-2026-0329](https://insights.sbomify.com/RUSTSEC-2026-0329/): Auto-Reseeding HMAC-DRBG could panic for some output lengths (not scored)
- [RUSTSEC-2026-0328](https://insights.sbomify.com/RUSTSEC-2026-0328/): `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip) (not scored)
- [RUSTSEC-2026-0319](https://insights.sbomify.com/RUSTSEC-2026-0319/): anymap2 is unmaintained (not scored)
- [RUSTSEC-2026-0318](https://insights.sbomify.com/RUSTSEC-2026-0318/): Sending custom to-device messages may panics (not scored)
- [RUSTSEC-2026-0317](https://insights.sbomify.com/RUSTSEC-2026-0317/): A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process (not scored)
- [RUSTSEC-2026-0312](https://insights.sbomify.com/RUSTSEC-2026-0312/): Excluded iPAddress name constraints with an all-zero mask are not applied (not scored)
- [RUSTSEC-2026-0311](https://insights.sbomify.com/RUSTSEC-2026-0311/): Stack overflow on deeply nested LaTeX input (not scored)
- [RUSTSEC-2026-0310](https://insights.sbomify.com/RUSTSEC-2026-0310/): Various panics, soundness and resource exhaustion issues (not scored)
- [RUSTSEC-2026-0309](https://insights.sbomify.com/RUSTSEC-2026-0309/): `SinglyLinkedList::remove` dereferences a null link (not scored)
- [RUSTSEC-2026-0308](https://insights.sbomify.com/RUSTSEC-2026-0308/): Use-after-free in interned values and cached function results (not scored)
- [RUSTSEC-2026-0307](https://insights.sbomify.com/RUSTSEC-2026-0307/): `uncbv`: archive extraction is vulnerable to path traversal (zip-slip) (not scored)
- [RUSTSEC-2026-0306](https://insights.sbomify.com/RUSTSEC-2026-0306/): `hex_decode_unchecked` AVX2 path reads past `src` (not scored)
- [RUSTSEC-2026-0304](https://insights.sbomify.com/RUSTSEC-2026-0304/): Finished streaming calls keep reading a stalled request body indefinitely (not scored)
- [RUSTSEC-2026-0303](https://insights.sbomify.com/RUSTSEC-2026-0303/): `stack-graphs` is archived and unmaintained (not scored)
- [RUSTSEC-2026-0302](https://insights.sbomify.com/RUSTSEC-2026-0302/): `stack-graphs` C API exports are safe `extern "C"` functions (not scored)
- [RUSTSEC-2026-0301](https://insights.sbomify.com/RUSTSEC-2026-0301/): Double free in `StackVec::retain` when a predicate or element `Drop` panics (not scored)
- [RUSTSEC-2026-0300](https://insights.sbomify.com/RUSTSEC-2026-0300/): Use-after-free in `clear` and `retain` when an element's `Drop` panics (not scored)
- [RUSTSEC-2026-0299](https://insights.sbomify.com/RUSTSEC-2026-0299/): `owned-alloc` is unmaintained (not scored)
- [RUSTSEC-2026-0298](https://insights.sbomify.com/RUSTSEC-2026-0298/): Use-after-free when a future's `Drop` panics while the container is dropped (not scored)
- [RUSTSEC-2026-0297](https://insights.sbomify.com/RUSTSEC-2026-0297/): `unzip`: archive extraction is vulnerable to path traversal (zip-slip) (not scored)
- [RUSTSEC-2026-0296](https://insights.sbomify.com/RUSTSEC-2026-0296/): `unzip` is unmaintained (not scored)
- [RUSTSEC-2026-0295](https://insights.sbomify.com/RUSTSEC-2026-0295/): Memory corruption bug on `ApplyResult` type (not scored)
- [RUSTSEC-2026-0293](https://insights.sbomify.com/RUSTSEC-2026-0293/): Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics (not scored)
- [RUSTSEC-2026-0292](https://insights.sbomify.com/RUSTSEC-2026-0292/): Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics (not scored)
- [RUSTSEC-2026-0291](https://insights.sbomify.com/RUSTSEC-2026-0291/): Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics (not scored)
- [RUSTSEC-2026-0290](https://insights.sbomify.com/RUSTSEC-2026-0290/): pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery (not scored)
- [RUSTSEC-2026-0289](https://insights.sbomify.com/RUSTSEC-2026-0289/): pqc_kyber is unmaintained (not scored)
- [RUSTSEC-2026-0288](https://insights.sbomify.com/RUSTSEC-2026-0288/): cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery (not scored)
- [RUSTSEC-2026-0287](https://insights.sbomify.com/RUSTSEC-2026-0287/): cosmian_kyber is unmaintained (not scored)
- [RUSTSEC-2026-0286](https://insights.sbomify.com/RUSTSEC-2026-0286/): Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS (not scored)
- [RUSTSEC-2026-0284](https://insights.sbomify.com/RUSTSEC-2026-0284/): Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear` (not scored)
- [RUSTSEC-2026-0283](https://insights.sbomify.com/RUSTSEC-2026-0283/): clear_on_drop is unmaintained (not scored)
- [RUSTSEC-2026-0282](https://insights.sbomify.com/RUSTSEC-2026-0282/): Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics (not scored)
- [RUSTSEC-2026-0281](https://insights.sbomify.com/RUSTSEC-2026-0281/): `greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code (not scored)
- [RUSTSEC-2026-0280](https://insights.sbomify.com/RUSTSEC-2026-0280/): `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code (not scored)
- [RUSTSEC-2026-0276](https://insights.sbomify.com/RUSTSEC-2026-0276/): Path traversal in apimock-server's file-serving fallback (not scored)
- [RUSTSEC-2026-0275](https://insights.sbomify.com/RUSTSEC-2026-0275/): Legacy `azure_core` writes the `authorization` header value to logs (not scored)
- [RUSTSEC-2026-0274](https://insights.sbomify.com/RUSTSEC-2026-0274/): Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics (not scored)
- [RUSTSEC-2026-0273](https://insights.sbomify.com/RUSTSEC-2026-0273/): Stubbed cryptography without warnings (not scored)
- [RUSTSEC-2026-0272](https://insights.sbomify.com/RUSTSEC-2026-0272/): Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free) (not scored)
- [RUSTSEC-2026-0271](https://insights.sbomify.com/RUSTSEC-2026-0271/): FTP command injection via CRLF in control channel arguments (not scored)
- [RUSTSEC-2026-0270](https://insights.sbomify.com/RUSTSEC-2026-0270/): `sp-sized-chunks` is unmaintained (not scored)
- [RUSTSEC-2026-0267](https://insights.sbomify.com/RUSTSEC-2026-0267/): Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free) (not scored)
- [RUSTSEC-2026-0266](https://insights.sbomify.com/RUSTSEC-2026-0266/): `internment` 0.8.7 was removed from crates.io due to a malicious dependency (not scored)
- [RUSTSEC-2026-0265](https://insights.sbomify.com/RUSTSEC-2026-0265/): `proc-macro1` was removed from crates.io due to malicious code (not scored)
- [RUSTSEC-2026-0264](https://insights.sbomify.com/RUSTSEC-2026-0264/): `proc-macro-en` was removed from crates.io due to malicious code (not scored)
- [RUSTSEC-2026-0263](https://insights.sbomify.com/RUSTSEC-2026-0263/): `tinymember` was removed from crates.io due to affiliation with malicious code (not scored)
- [RUSTSEC-2026-0262](https://insights.sbomify.com/RUSTSEC-2026-0262/): `append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency (not scored)
- [RUSTSEC-2026-0261](https://insights.sbomify.com/RUSTSEC-2026-0261/): `aronenao` was removed from crates.io due to malicious code (not scored)
- [RUSTSEC-2026-0260](https://insights.sbomify.com/RUSTSEC-2026-0260/): `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency (not scored)
- [RUSTSEC-2026-0259](https://insights.sbomify.com/RUSTSEC-2026-0259/): `arone` was removed from crates.io due to malicious code (not scored)
- [RUSTSEC-2026-0258](https://insights.sbomify.com/RUSTSEC-2026-0258/): h2 unbounded empty DATA frames (not scored)
- [RUSTSEC-2026-0257](https://insights.sbomify.com/RUSTSEC-2026-0257/): Unix `BROWSER` handling allows browser argument injection (not scored)
- [RUSTSEC-2026-0256](https://insights.sbomify.com/RUSTSEC-2026-0256/): Several methods in `circular-buffer` drop elements before updating the buffer's start/end metadata. (not scored)
- [RUSTSEC-2026-0255](https://insights.sbomify.com/RUSTSEC-2026-0255/): Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free) (not scored)
- [RUSTSEC-2026-0254](https://insights.sbomify.com/RUSTSEC-2026-0254/): Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free) (not scored)
- [RUSTSEC-2026-0253](https://insights.sbomify.com/RUSTSEC-2026-0253/): Potential use-after-free due to lack of panic safety in `LruCache::pop()` (not scored)
- [RUSTSEC-2026-0252](https://insights.sbomify.com/RUSTSEC-2026-0252/): Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read) (not scored)
- [RUSTSEC-2026-0251](https://insights.sbomify.com/RUSTSEC-2026-0251/): sized-chunks is unmaintained (not scored)
- [RUSTSEC-2026-0250](https://insights.sbomify.com/RUSTSEC-2026-0250/): im-rc is unmaintained (not scored)
- [RUSTSEC-2026-0249](https://insights.sbomify.com/RUSTSEC-2026-0249/): smartstring is unmaintained (not scored)
- [RUSTSEC-2026-0248](https://insights.sbomify.com/RUSTSEC-2026-0248/): im is unmaintained (not scored)
- [RUSTSEC-2026-0247](https://insights.sbomify.com/RUSTSEC-2026-0247/): bitmaps is unmaintained (not scored)
- [RUSTSEC-2026-0246](https://insights.sbomify.com/RUSTSEC-2026-0246/): `sevenz-rust` is unmaintained (not scored)
- [RUSTSEC-2026-0245](https://insights.sbomify.com/RUSTSEC-2026-0245/): Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write. (not scored)
- [RUSTSEC-2026-0244](https://insights.sbomify.com/RUSTSEC-2026-0244/): `setlocale` and `TextDomain::init` are unsound as they access environment with no synchronization (not scored)
- [RUSTSEC-2026-0243](https://insights.sbomify.com/RUSTSEC-2026-0243/): `nostr-relay-pool` is unmaintained (not scored)
- [RUSTSEC-2026-0242](https://insights.sbomify.com/RUSTSEC-2026-0242/): Safe ErrorRegistry APIs can cause undefined behavior (not scored)
- [RUSTSEC-2026-0241](https://insights.sbomify.com/RUSTSEC-2026-0241/): `nostr-keyring` is unmaintained (not scored)
- [RUSTSEC-2026-0240](https://insights.sbomify.com/RUSTSEC-2026-0240/): Ed25519 identity public keys permit universal signature forgery (not scored)
- [RUSTSEC-2026-0239](https://insights.sbomify.com/RUSTSEC-2026-0239/): Streaming AEAD does not authenticate stream structure (not scored)
- [RUSTSEC-2026-0238](https://insights.sbomify.com/RUSTSEC-2026-0238/): Low-level GCM ignores the operation nonce (not scored)
- [RUSTSEC-2026-0237](https://insights.sbomify.com/RUSTSEC-2026-0237/): `nostr-relay-builder` is unmaintained (not scored)
- [RUSTSEC-2026-0236](https://insights.sbomify.com/RUSTSEC-2026-0236/): A `BigInt` division panics, and two neighbouring operations answer wrongly in silence (not scored)
- [RUSTSEC-2026-0235](https://insights.sbomify.com/RUSTSEC-2026-0235/): Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc (not scored)
- [RUSTSEC-2026-0234](https://insights.sbomify.com/RUSTSEC-2026-0234/): Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables (not scored)
- [RUSTSEC-2026-0233](https://insights.sbomify.com/RUSTSEC-2026-0233/): Crafted archives can cause a use-after-free during deserialization (not scored)
- [RUSTSEC-2026-0232](https://insights.sbomify.com/RUSTSEC-2026-0232/): Processing of unverified relay events (not scored)
- [RUSTSEC-2026-0231](https://insights.sbomify.com/RUSTSEC-2026-0231/): Relay authentication challenges can exhaust memory (not scored)
- [RUSTSEC-2026-0230](https://insights.sbomify.com/RUSTSEC-2026-0230/): Empty NIP-50 search filters can panic (not scored)
- [RUSTSEC-2026-0229](https://insights.sbomify.com/RUSTSEC-2026-0229/): NIP-98 authorization parsing permits resource exhaustion (not scored)
- [RUSTSEC-2026-0228](https://insights.sbomify.com/RUSTSEC-2026-0228/): NIP-04 parsing amplifies malformed ciphertext memory use (not scored)
- [RUSTSEC-2026-0227](https://insights.sbomify.com/RUSTSEC-2026-0227/): NIP-44 v2 decryption permits resource exhaustion (not scored)
- [RUSTSEC-2026-0226](https://insights.sbomify.com/RUSTSEC-2026-0226/): Wallet event parsers accept unauthenticated events (not scored)
- [RUSTSEC-2026-0225](https://insights.sbomify.com/RUSTSEC-2026-0225/): Debug output exposes NIP-46 and NIP-60 credentials (not scored)
- [RUSTSEC-2026-0224](https://insights.sbomify.com/RUSTSEC-2026-0224/): Verification cache poisoning allows forged Nostr events to bypass signature validation (not scored)
- [RUSTSEC-2026-0221](https://insights.sbomify.com/RUSTSEC-2026-0221/): `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot` (not scored)
- [RUSTSEC-2026-0220](https://insights.sbomify.com/RUSTSEC-2026-0220/): Uint shift operations: incorrect overflow flags and truncated shift amounts (not scored)
- [RUSTSEC-2026-0219](https://insights.sbomify.com/RUSTSEC-2026-0219/): Remote Denial of Service via malformed NIP-04 IV (not scored)
- [RUSTSEC-2026-0218](https://insights.sbomify.com/RUSTSEC-2026-0218/): `Enum` trait allows type confusion when manually implemented (not scored)
- [RUSTSEC-2026-0216](https://insights.sbomify.com/RUSTSEC-2026-0216/): Remote Denial of Service via malformed NIP‑44 v2 payload (not scored)
- [RUSTSEC-2026-0215](https://insights.sbomify.com/RUSTSEC-2026-0215/): smallstr is unmaintained (not scored)
- [RUSTSEC-2026-0214](https://insights.sbomify.com/RUSTSEC-2026-0214/): gumdrop is unmaintained (not scored)
- [RUSTSEC-2026-0212](https://insights.sbomify.com/RUSTSEC-2026-0212/): Potentially Incorrect Output of Constant-Time Swap/Select on Aarch64 (not scored)
- [RUSTSEC-2026-0211](https://insights.sbomify.com/RUSTSEC-2026-0211/): Non-constant time Authentication Tag Check in AES-GCM Decryption (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/5/