deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4chv-4c6w-w254
Package: soroban-sdk-macros (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: >= 25.0.0, <= 25.1.0
Patched in: 25.1.1

Summary: The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

Details:
### Impact

The `#[contractimpl]` macro contains a bug in how it wires up function calls.

In Rust, you can define functions on a type in two ways:
- Directly on the type as an inherent function:
  ```rust
  impl MyContract {
      fn value() { ... }
  }
  ```
- Through a trait
  ```rust
  impl Trait for MyContract {
      fn value() { ... }
  }
  ```

These are two separate functions that happen to share the same name. Rust has rules for which one gets called. When you write `MyContract::value()`, Rust always picks the one defined directly on the type, not the trait version.

The bug is that `#[contractimpl]` generates code that uses `MyContract::value()` style calls even when it's processing the trait version. This means if an inherent function is also defined with the same name, the inherent function gets called instead of the trait function.

This means the Wasm-exported entry point silently calls the wrong function when two conditions are met simultaneously:
1. A `impl Trait for MyContract` block is defined with one or more functions, with `#[contractimpl]` applied.
2. A `impl MyContract` block is defined with one or more identically named functions, without `#[contractimpl]` applied.

If the trait version contains important security checks, such as verifying the caller is authorized, that the inherent version does not, those checks are bypassed. Anyone interacting with the contract through its public interface will call the wrong function.

For example:

```rust
#[contract]
pub struct Contract;

impl Contract {
    /// Inherent function — returns 1.
    /// Bug: The macro-generated WASM export is wired up to call this function.
    pub fn value() -> u32 {
        1
    }
}

pub trait Trait {
    fn value(env: Env) -> u32;
}

#[contractimpl]
impl Trait for MyContract {
    /// Trait implementation — returns 2.
    /// Fix: The macro-generated WASM export should call this function.
    fn value() -> u32 {
        2
    }
}
```

### Patches

The problem is patched in `soroban-sdk-macros` version **25.1.1**. The fix changes the generated call from `<Type>::func()` to `<Type as Trait>::func()` when processing trait implementations, ensuring Rust resolves to the trait associated function regardless of whether an inherent function with the same name exists.

Users should upgrade to `soroban-sdk-macros` **>= 25.1.1** and recompile their contracts.

### Workarounds

If upgrading is not immediately possible, contract developers can avoid the issue by ensuring that no inherent associated function on the contract type shares a name with any function in the trait implementation. Renaming or removing the conflicting inherent function eliminates the ambiguity and causes the macro-generated code to correctly resolve to the trait function.
GitHub Security Advisory: GHSA-p5vf-5754-x7p3
Package: polymarket-client-sdks (RUST)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `polymarket-client-sdks` was removed from crates.io for malicious code

Details:
It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`sdks` vs `sdk`) and attempting to steal credentials from local files.

The malicious crate had 1 version published on 2026-02-09 and had been downloaded only 33 times. There were no crates depending on this crate on crates.io.

Thanks to Roland Peelen for finding and reporting this to the crates.io team!
GitHub Security Advisory: GHSA-c7ph-f7jm-xv4w
Package: pgp (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-354: Improper Validation of Integrity Check Value
Vulnerable versions: >= 0.16.0-alpha.0, < 0.19.0
Patched in: 0.19.0

Summary: rPGP's integrity protection of encrypted data was not always checked

Details:
### Summary
For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid.

### Details
When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all circumstances report the absence of valid integrity protection to callers of the library.

### Impact
While the resulting invalid decryption output is not attacker controlled, its contents may be a security concern if an attacker can gain access to it.

### Attribution
Discovered internally in the course of rPGP development work.
GitHub Security Advisory: GHSA-8h58-w33p-wq3g
Package: pgp (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-121: Stack-based Buffer Overflow
Vulnerable versions: >= 0.16.0-alpha.0, < 0.19.0
Patched in: 0.19.0

Summary: rPGP affected by crash in message handling for deeply nested messages

Details:
### Summary
Previous rPGP versions could be caused to crash with a "stack overflow" when parsing messages that contain deeply nested message layers, such as messages with many signatures.

rPGP 0.19.0 resolves this issue with a more robust message handling implementation (via https://github.com/rpgp/rpgp/pull/625).

### Impact
An attacker could cause applications to crash in rPGP's message parsing subsystem, when applications attempt to ingest messages.

### Attribution
Discovered internally during rPGP development, using a fuzz test suite previously contributed by Christian Reitter.
GitHub Security Advisory: GHSA-7587-4wv6-m68m
Package: pgp (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-703: Improper Check or Handling of Exceptional Conditions
Vulnerable versions: >= 0.16.0-alpha.0, < 0.19.0
Patched in: 0.19.0

Summary: rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895

Details:
### Summary
It was possible to trigger an unhandled edge case in the Rust Crypto rsa crate through rPGP packet parsing functionality, and crash the process that runs rPGP. This problem has been patched in a new rsa version. The new release of rPGP ensures a patched version of the rsa crate is in use, which prevents this issue.

### Details
While parsing a special RSA secret key packet, rPGP calls the rsa crate with the provided key. On vulnerable versions, this results in a Rust "panic" during key construction. Note that an attacker can trigger this situation even in places where applications don't expect to handle foreign key material, for example while attempting to receive a message.

For more information on the rsa crate vulnerability, see https://github.com/RustCrypto/RSA/security/advisories/GHSA-9c48-w39g-hm26 and https://github.com/RustCrypto/RSA/pull/624.
In rPGP, this has been fixed via https://github.com/rpgp/rpgp/pull/698.

### Impact
This issue impacts availability (i.e. applications can crash).

Affected rPGP versions: rPGP 0.16.0-alpha.0 to 0.18.0
Vulnerable rsa versions: all before version 0.9.10

### Workaround
The issue depends on the combination of affected rPGP and rsa versions. Users of affected rPGP versions can pin the patched rsa 0.9.10 via a cargo lockfile to mitigate the issue.

### Attribution
Discovered by Christian Reitter from Radically Open Security during a security review for Proton AG.
GitHub Security Advisory: GHSA-g433-pq76-6cmf
Package: hpke-rs-rust-crypto (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-190: Integer Overflow or Wraparound, CWE-697: Incorrect Comparison
Vulnerable versions: < 0.6.0
Patched in: 0.6.0

Summary: Bug fixes in hpke-rs, hpke-rs-rust-crypto

Details:
We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:

## hpke-rs
- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom<u16>` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.
- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.
- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)

The issue fixed in #123 was first reported by Nadim Kobeissi.
The issues fixed in #127 and #128 were first reported by Scott Arciszewski.

## hpke-rs-rust-crypto
- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys

The issue fixed in #124 was first reported by Nadim Kobeissi.
GitHub Security Advisory: GHSA-g433-pq76-6cmf
Package: hpke-rs (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-190: Integer Overflow or Wraparound, CWE-697: Incorrect Comparison
Vulnerable versions: < 0.6.0
Patched in: 0.6.0

Summary: Bug fixes in hpke-rs, hpke-rs-rust-crypto

Details:
We publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the hpke-rs and hpke-rs-rust-crypto crates contain the following bug-fixes:

## hpke-rs
- [#127](https://github.com/cryspen/hpke-rs/pull/127): Fix `KemAlgorithm::TryFrom<u16>` mapping where `0x004D` incorrectly resolved to `XWingDraft06` instead of `XWingDraft06Obsolete`.
- [#123](https://github.com/cryspen/hpke-rs/pull/123): Fix potential overflow in context counter and switch to use u64.
- [#128](https://github.com/cryspen/hpke-rs/pull/128): Return errors when trying to use open/seal with export only ciphersuite and when using kdf export with an output that's too long (instead of truncating it)

The issue fixed in #123 was first reported by Nadim Kobeissi.
The issues fixed in #127 and #128 were first reported by Scott Arciszewski.

## hpke-rs-rust-crypto
- [#124](https://github.com/cryspen/hpke-rs/pull/124): Error out on x25519 0 keys

The issue fixed in #124 was first reported by Nadim Kobeissi.
GitHub Security Advisory: GHSA-435g-fcv3-8j26
Package: libcrux-psq (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: <= 0.0.6
Patched in: 0.0.7

Summary: Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

Details:
In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:

## `libcrux-ecdh`

- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length

## `libcrux-ed25519`

- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation

The issue fixed in #1320 was first reported by Nadim Kobeissi.
## `libcrux-psq`

- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking
- [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys

The issue fixed in #1319 was first reported by Nadim Kobeissi.
GitHub Security Advisory: GHSA-435g-fcv3-8j26
Package: libcrux-ed25519 (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: <= 0.0.5
Patched in: 0.0.6

Summary: Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

Details:
In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:

## `libcrux-ecdh`

- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length

## `libcrux-ed25519`

- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation

The issue fixed in #1320 was first reported by Nadim Kobeissi.
## `libcrux-psq`

- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking
- [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys

The issue fixed in #1319 was first reported by Nadim Kobeissi.
GitHub Security Advisory: GHSA-435g-fcv3-8j26
Package: libcrux-ecdh (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-20: Improper Input Validation, CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: <= 0.0.5
Patched in: 0.0.6

Summary: Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`

Details:
In accordance with our [security policy for `libcrux`](https://github.com/cryspen/libcrux/blob/main/SECURITY.md), we publish a GitHub security advisory for any releases whose CHANGELOG includes bug-fixes, and encourage our users to upgrade. The latest releases of the `libcrux-ecdh`, `libcrux-ed25519` and `libcrux-psq` crates contain the following bug-fixes:

## `libcrux-ecdh`

- [#1301](https://github.com/cryspen/libcrux/pull/1301): Check length and clamping in X25519 secret validation. This is a breaking change since errors are now raised on unclamped X25519 secrets or inputs of the wrong length

## `libcrux-ed25519`

- [#1320](https://github.com/cryspen/libcrux/pull/1320): Remove duplicated clamping step during key generation

The issue fixed in #1320 was first reported by Nadim Kobeissi.
## `libcrux-psq`

- [#1319](https://github.com/cryspen/libcrux/pull/1319): Propagate AEADError instead of panicking
- [#1301](https://github.com/cryspen/libcrux/pull/1301): Fix broken clamping check for imported X25519 secret keys

The issue fixed in #1319 was first reported by Nadim Kobeissi.
GitHub Security Advisory: GHSA-xx7m-69ff-9crp
Package: surrealdb (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 3.0.0-alpha.8, < 3.0.0-beta.3
Patched in: 3.0.0-beta.3

Summary: SurrealDB vulnerable to Denial of Service through scripting function memory edge case

Details:
In SurrealDB instances with the scripting capability enabled (`--allow-scripting`),  users with the ability to run arbitrary queries can trigger a server crash due to a memory-safety bug in the underlying JS engine. The SurrealDB instance terminates instantly, requiring a manual restart.

The query consists of using built-in string functions to construct a large string and passing it to the JavaScript runtime for compilation. The exact string size required to trigger the crash varies between SurrealDB versions.

Whilst exploiting the vulnerability requires users to be able to run arbitrary queries, if guest access (`--allow-guests`), is enabled, then guests can perform this attack.

### Impact

Any user able to execute queries on a SurrealDB instance with scripting enabled (`--allow-scripting`) can cause complete denial of service. The server process terminates immediately without graceful shutdown.

The underlying cause of the vulnerability is a null pointer dereference in the `QuickJS-NG` v0.8 JavaScript engine, this vulnerability cannot be exploited to execute arbitrary code, or compromise the integrity or confidentiality of data. 

### Patches

Versions prior to SurrealDB `v2.6.1` and `v3.0.0-beta.3` are vulnerable.

The patches for SurrealDB `v2.6.1` and `v3.0.0-beta.3` update the `rquickjs` dependency from `v0.9.0` to `v0.11.0`, which in turn uses an updated version of `QuickJS-NG`.

### Workarounds
Deny execution of embedded scripting functions through the configuration of [capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#capabilities) by starting SurrealDB with the `--deny-scripting` flag or the equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. This has a usability implication, although scripting functions are disabled by default.

Administrators can also use `--deny-arbitrary-query`  to deny arbitrary querying by either `guest`, `record` or `system` users, or a combination of those, with impacts to functionality for those users. 

### Links ###
[SurrealDB Documentation - Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities)
[SurrealDB Documentation - Guest Access](https://surrealdb.com/docs/surrealdb/security/capabilities#guest-access)
[SurrealQL Documentation - Scripting Functions](https://surrealdb.com/docs/surrealql/functions/script)
[quickjs-ng v0.9 Release Notes](https://github.com/quickjs-ng/quickjs/releases/tag/v0.9.0)
https://github.com/surrealdb/surrealdb/pull/6833
https://github.com/surrealdb/surrealdb/pull/6774
GitHub Security Advisory: GHSA-xx7m-69ff-9crp
Package: surrealdb (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: < 2.6.1
Patched in: 2.6.1

Summary: SurrealDB vulnerable to Denial of Service through scripting function memory edge case

Details:
In SurrealDB instances with the scripting capability enabled (`--allow-scripting`),  users with the ability to run arbitrary queries can trigger a server crash due to a memory-safety bug in the underlying JS engine. The SurrealDB instance terminates instantly, requiring a manual restart.

The query consists of using built-in string functions to construct a large string and passing it to the JavaScript runtime for compilation. The exact string size required to trigger the crash varies between SurrealDB versions.

Whilst exploiting the vulnerability requires users to be able to run arbitrary queries, if guest access (`--allow-guests`), is enabled, then guests can perform this attack.

### Impact

Any user able to execute queries on a SurrealDB instance with scripting enabled (`--allow-scripting`) can cause complete denial of service. The server process terminates immediately without graceful shutdown.

The underlying cause of the vulnerability is a null pointer dereference in the `QuickJS-NG` v0.8 JavaScript engine, this vulnerability cannot be exploited to execute arbitrary code, or compromise the integrity or confidentiality of data. 

### Patches

Versions prior to SurrealDB `v2.6.1` and `v3.0.0-beta.3` are vulnerable.

The patches for SurrealDB `v2.6.1` and `v3.0.0-beta.3` update the `rquickjs` dependency from `v0.9.0` to `v0.11.0`, which in turn uses an updated version of `QuickJS-NG`.

### Workarounds
Deny execution of embedded scripting functions through the configuration of [capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities#capabilities) by starting SurrealDB with the `--deny-scripting` flag or the equivalent environment variable `SURREAL_CAPS_DENY_SCRIPT=true`. This has a usability implication, although scripting functions are disabled by default.

Administrators can also use `--deny-arbitrary-query`  to deny arbitrary querying by either `guest`, `record` or `system` users, or a combination of those, with impacts to functionality for those users. 

### Links ###
[SurrealDB Documentation - Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities)
[SurrealDB Documentation - Guest Access](https://surrealdb.com/docs/surrealdb/security/capabilities#guest-access)
[SurrealQL Documentation - Scripting Functions](https://surrealdb.com/docs/surrealql/functions/script)
[quickjs-ng v0.9 Release Notes](https://github.com/quickjs-ng/quickjs/releases/tag/v0.9.0)
https://github.com/surrealdb/surrealdb/pull/6833
https://github.com/surrealdb/surrealdb/pull/6774
GitHub Security Advisory: GHSA-vgr2-r5hm-f6gf
Package: sha-rst (RUST)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `sha-rst` was removed from crates.io for malicious code

Details:
This crate was used as a dependency by `finch_cli_rust` and `finch-rst` and contained a malware payload to exfiltrate credentials.

The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above that were part of the attack, no other crates depedended on this crate.

Thanks to Matthias Zepper of [NGI Sweden](https://ngisweden.scilifelab.se/) for reporting this to the crates.io team!
GitHub Security Advisory: GHSA-6v2j-vr4h-f632
Package: finch_cli_rust (RUST)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `finch_cli_rust` was removed from crates.io for malicious code

Details:
This attempts to typosquat the existing crate [`finch_cli`](https://crates.io/crates/finch_cli) to steal credentials from local files.

The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io.

Thanks to Matthias Zepper of [NGI Sweden](https://ngisweden.scilifelab.se/) for reporting this to the crates.io team!
GitHub Security Advisory: GHSA-xp79-9mxw-878j
Package: finch-rst (RUST)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-506: Embedded Malicious Code
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `finch-rst` was removed from crates.io for malicious code

Details:
This attempts to typosquat the existing crate [`finch`](https://crates.io/crates/finch) to steal credentials from local files.

The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this crate on crates.io.

Thanks to Matthias Zepper of [NGI Sweden](https://ngisweden.scilifelab.se/) for reporting this to the crates.io team!
GitHub Security Advisory: GHSA-585q-cm62-757j
Package: mnl (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: <= 0.3.0
Patched in: 0.3.1

Summary: mnl has segmentation fault and invalid memory read in `mnl::cb_run`

Details:
The function `mnl::cb_run` is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.

Passing a crafted byte slice to `mnl::cb_run` can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.

This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.
GitHub Security Advisory: GHSA-x468-phr8-h3p3
Package: uniswap-utils (RUST)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `uniswap-utils` was removed from crates.io for malicious code

Details:
It depended on the `evm-units` crate, which appeared to be attempting to steal cryptocurrency.
GitHub Security Advisory: GHSA-3mmg-7c2q-8938
Package: sha-rust (RUST)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `sha-rust` was removed from crates.io for malicious code

Details:
It appeared to be attempting to steal credentials from local files.
GitHub Security Advisory: GHSA-f8h5-x737-x4xr
Package: finch-rust (RUST)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: >= 0
Patched in: unpatched

Summary: `finch-rust` was removed from crates.io for malicious code

Details:
It depended on the `sha-rust` crate, which appeared to be attempting to steal credentials from local files.