deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-2pgj-5cv2-6xxw
Package: fuel-vm (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-416: Use After Free
Vulnerable versions: < 0.59.3
Patched in: 0.59.3

Summary: FuelVM is vulnerable to heap memory allocation re-use bug

Details:
### Impact

A memory safety vulnerability was present in the Fuel Virtual Machine (FuelVM), where memory reads could bypass expected access controls. Specifically, when a smart contract performed a `mload` (or other opcodes which access memory) on memory that had been deallocated using `ret`, it was still able to access the old memory contents. This occurred because the memory region was not zeroed out or otherwise marked as invalid. As a result, smart contracts could potentially read sensitive data left over from other contracts if the same memory was reallocated, violating isolation guarantees between contracts and enabling unintended data leakage.

All users running affected versions of FuelVM that relied on strict memory isolation between smart contracts were impacted.

### Patches

The vulnerability was patched by modifying the FuelVM to ensure that memory deallocated with `ret` was zeroed out or made inaccessible. The fix was included in FuelVM version `v0.60.1` and back-ported to `v0.59.3`. This patch was released to the Fuel network on Friday, April 18th, 2025.

### Workarounds

There were no reliable workarounds that fully mitigated the vulnerability. While developers could manually zero out sensitive memory regions before returning from a function, this approach was error-prone and could not be enforced at the VM level. Upgrading to a patched version remained the recommended course of action.

### References

- Fix implemented in the FuelVM GitHub repository (https://github.com/FuelLabs/fuel-vm/pull/941)
GitHub Security Advisory: GHSA-466c-pfvv-v83g
Package: wrflib (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerable versions: <= 0.0.3
Patched in: unpatched

Summary: wrflib has a soundness issue and is unmaintained

Details:
All functions under `wrflib::byte_extract` are simply wrapper of unsafe pointer offset and lacks sufficient checks to it pointer and offset parameter.

`wrflib` is unmaintained.
GitHub Security Advisory: GHSA-5rxf-fqch-7vqp
Package: routinator (RUST)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-35: Path Traversal: '.../...//'
Vulnerable versions: >= 0.9.0, < 0.12.2
Patched in: 0.12.2

Summary: NLnet Labs’ Routinator vulnerable to path traversal

Details:
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it.
GitHub Security Advisory: GHSA-32jf-h775-g29h
Package: mongodb (RUST)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-228: Improper Handling of Syntactically Invalid Structure
Vulnerable versions: >= 2.0.0, < 2.8.2
Patched in: 2.8.2

Summary: MongoDB Rust driver may issue unintended commands

Details:
Incorrect handling of certain string inputs may result in MongoDB Rust driver constructing unintended server commands. This may cause unexpected application behavior including data modification. This issue affects MongoDB Rust Driver 2.0 versions prior to 2.8.2
GitHub Security Advisory: GHSA-7vm2-j586-vcvc
Package: SurrealDB (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 3.0.0-alpha.0, < 3.0.0-alpha.7
Patched in: 3.0.0-alpha.8

Summary: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Details:
`LIVE SELECT` statements are used to capture changes to data within a table in real time. Documents included in `WHERE` conditions and `DELETE` notifications were not properly reduced to respect the querying user's security context. Instead the leaked documents reflect the context of the user triggering the notification.

This allows a record or guest user with permissions to run live query subscriptions on a table to observe unauthorised records within the same table, when another user is altering or deleting these records, bypassing access controls.

### Impact
A record or guest user with permissions to run live query subscriptions on a table is able to observe unauthorised records within the same table, with unauthorised records returned when deleted, or when records matching the WHERE conditions are created, updated, or deleted, by another user. This impacts confidentiality, limited to the table the attacker has access to, and with the data disclosed dependent of the actions taken by other users.

### Patches
A patch has been created for the following versions:

- Versions 2.1.9, 2.2.8 and 2.3.8 and later are not affected by this issue. 
- The first release following v3.0.0-alpha.7 will be patched.

### Workarounds
Assess the impact of users with permissions on table records effectively having full read access to the table, use separate tables if required, with impacts to functionality.
GitHub Security Advisory: GHSA-98f8-j56x-2hh4
Package: surrealdb (RUST)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.3.0, < 2.3.8
Patched in: unpatched

Summary: Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Details:
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-7vm2-j586-vcvc. This link is maintained to preserve external references.

## Original Description
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
GitHub Security Advisory: GHSA-pg9f-39pc-qf8g
Package: crossbeam-channel (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-415: Double Free
Vulnerable versions: >= 0.5.12, < 0.5.15
Patched in: 0.5.15

Summary: crossbeam-channel Vulnerable to Double Free on Drop

Details:
The internal `Channel` type's `Drop` method has a race
which could, in some circumstances, lead to a double-free.
This could result in memory corruption.

Quoting from the
[upstream description in merge request \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187#issue[PII_REDACTED]):

> The problem lies in the fact that `dicard_all_messages` contained two paths that could lead to `head.block` being read but only one of them would swap the value. This meant that `dicard_all_messages` could end up observing a non-null block pointer (and therefore attempting to free it) without setting `head.block` to null. This would then lead to `Channel::drop` making a second attempt at dropping the same pointer.

The bug was introduced while fixing a memory leak, in
upstream [MR \#1084](https://github.com/crossbeam-rs/crossbeam/pull/1084),
first published in 0.5.12.

The fix is in
upstream [MR \#1187](https://github.com/crossbeam-rs/crossbeam/pull/1187)
and has been published in 0.5.15
GitHub Security Advisory: GHSA-3wgq-wrwc-vqmv
Package: astral-tokio-tar (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: <= 0.5.3
Patched in: 0.5.4

Summary: astral-tokio-tar has a path traversal in tar extraction

Details:
### Impact

In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the `Entry::unpack_in_raw` API. Additionally, the `Entry::allow_external_symlinks` control (which defaults to `true`) could be bypassed via a pair of symlinks that individually point within the destination but combine to point outside of it.

These behaviors could be used individually or combined to bypass the intended security control of limiting extraction to the given directory. This in turn would allow an attacker with a malicious tar archive to perform an arbitrary file write and potentially pivot into code execution (e.g. by overwriting a file that the user or system then executes or uses to execute code). 

The impact of this vulnerability for downstream API users of this crate is **high**, per above. However, for this crate's main downstream user (uv), the impact of this vulnerability is **low** due to its overlap with equivalent user capabilities in source distributions. See GHSA-7j9j-68r2-f35q for additional details.

### Patches

Versions 0.5.4 and newer of astral-tokio-tar address the vulnerability above. Users should upgrade to 0.5.4 or newer.

### Workarounds

Users are advised to upgrade to version 0.5.4 or newer to address this advisory.

There is no workaround other than upgrading.

### References

* See GHSA-7j9j-68r2-f35q for how this vulnerability affects uv, astral-tokio-tar's primary downstream user. Observe that **unlike** this advisory, uv's advisory is considered **low severity** due to overlap with intentional existing capabilities in source distributions.
* This vulnerability is similar to (but not related in code) to CVE-2025-4138 and CVE-2025-4517, which concern Python's tarfile module.
GitHub Security Advisory: GHSA-mm7x-qfjj-5g2c
Package: ammonia (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.3.1
Patched in: 3.3.1

Summary: Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

Details:
Affected versions of this crate did not correctly strip namespace-incompatible tags
in certain situations, causing it to incorrectly account for differences between HTML,
SVG, and MathML.

This vulnerability only has an effect when the `svg` or `math` tag is allowed,
because it relies on a tag being parsed as html during the cleaning process, but
serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML.
These [elements] are:

* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

[elements]: https://github.com/servo/html5ever/blob/57eb334c0ffccc6f88d563419f0fbeef6ff5741c/html5ever/src/tree_builder/rules.rs
GitHub Security Advisory: GHSA-mm7x-qfjj-5g2c
Package: ammonia (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.0.0, < 4.0.1
Patched in: 4.0.1

Summary: Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

Details:
Affected versions of this crate did not correctly strip namespace-incompatible tags
in certain situations, causing it to incorrectly account for differences between HTML,
SVG, and MathML.

This vulnerability only has an effect when the `svg` or `math` tag is allowed,
because it relies on a tag being parsed as html during the cleaning process, but
serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML.
These [elements] are:

* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

[elements]: https://github.com/servo/html5ever/blob/57eb334c0ffccc6f88d563419f0fbeef6ff5741c/html5ever/src/tree_builder/rules.rs
GitHub Security Advisory: GHSA-mm7x-qfjj-5g2c
Package: ammonia (RUST)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.1.0, < 4.1.2
Patched in: 4.1.2

Summary: Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal

Details:
Affected versions of this crate did not correctly strip namespace-incompatible tags
in certain situations, causing it to incorrectly account for differences between HTML,
SVG, and MathML.

This vulnerability only has an effect when the `svg` or `math` tag is allowed,
because it relies on a tag being parsed as html during the cleaning process, but
serialized in a way that causes in to be parsed as xml by the browser.

Additionally, the application using this library must allow a tag that is parsed as raw text in HTML.
These [elements] are:

* title
* textarea
* xmp
* iframe
* noembed
* noframes
* plaintext
* noscript
* style
* script

Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default.

[elements]: https://github.com/servo/html5ever/blob/57eb334c0ffccc6f88d563419f0fbeef6ff5741c/html5ever/src/tree_builder/rules.rs
GitHub Security Advisory: GHSA-393w-9x6h-8gc7
Package: pingora-core (RUST)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 0.6.0
Patched in: 0.6.0

Summary: Pingora update for MadeYouReset HTTP/2 vulnerability

Details:
Pingora deployments that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.

**Impact**:
On affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.

**Credits**:
Reported responsibly by security researcher [Gal Bar Nahum](https://github.com/galbarnahum) (@[galbarnahum](https://github.com/galbarnahum))

**Mitigation**:
This issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users should upgrade to the latest Pingora release, which incorporates the required fixes.
- Users are requested to upgrade to latest version of Pingora >= 0.6.0
GitHub Security Advisory: GHSA-4jwc-w2hc-78qv
Package: tonic (RUST)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-755: Improper Handling of Exceptional Conditions
Vulnerable versions: = 0.12.2
Patched in: 0.12.3

Summary: Tonic has remotely exploitable denial of service vulnerability

Details:
### Impact

When using `tonic::transport::Server` there is a remote DoS attack that can cause the server to exit cleanly on accepting a tcp/tls stream. This can be triggered via causing the accept call to error out with errors there were not covered correctly causing the accept loop to exit. 

More information can be found [here](https://github.com/hyperium/tonic/issues/1897)

### Patches

Upgrading to tonic `0.12.3` and above contains the fix. 

### Workarounds

A custom accept loop is a possible workaround.
GitHub Security Advisory: GHSA-cvmj-47v9-35m9
Package: fuser (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 0.16.0
Patched in: 0.16.0

Summary: FUSE-Rust: Uninitalized memory read and leak caused by fuser crate

Details:
During the creation of a new libfuse session with `fuse_session_new`, the operation list was passed as NULL incorrectly. libfuse expects this argument to always point to list of operations. This caused uninitialized memory read and leaks in libfuse.so.
GitHub Security Advisory: GHSA-hhw4-xg65-fp2x
Package: serde_yml (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: <= 0.0.12
Patched in: unpatched

Summary: serde_yml crate is unsound and unmaintained

Details:
Using `serde_yml::ser::Serializer.emitter` can cause a segmentation fault, which is unsound.

The GitHub project for `serde_yml` was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

## Recommended alternatives

- [`serde_norway`](https://crates.io/crates/serde_norway) - Maintained fork of `serde_yaml`, using `unsafe-libyaml-norway`
- [`serde_yaml_ng`](https://crates.io/crates/serde_yaml_ng) - Maintained fork of `serde_yaml`, using unmaintained `unsafe-libyaml`

## Incomplete pure Rust alternatives

These implementation do not rely on C `libyaml`.

- [`serde_yaml2`](https://crates.io/crates/serde_yaml2)
- [`yaml-peg`](https://crates.io/crates/yaml-peg)
GitHub Security Advisory: GHSA-gfxp-f68g-8x78
Package: libyml (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Vulnerable versions: >= 0.0.4, <= 0.0.5
Patched in: unpatched

Summary: LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

Details:
In version 0.0.4, `libyml::string::yaml_string_extend` was revised resulting in undefined behaviour, which is unsound.

The GitHub project for `libyml` was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

## Recommended alternatives

- [`libyaml-safer`](https://crates.io/crates/libyaml-safer) 
- [`unsafe-libyaml-norway`](https://crates.io/crates/unsafe-libyaml-norway) - Maintained fork of `unsafe-libyaml`
GitHub Security Advisory: GHSA-95hm-pr6q-298w
Package: fast-able (RUST)
Severity: HIGH (CVSS 0.0)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 1.13.7
Patched in: 1.13.7

Summary: fast-able is vulnerable to DoS attack through insecure method

Details:
The public accessible struct SyncVec has a public safe method get_unchecked. It accept a parameter index and used in the get_unchecked without sufficient checks as mentioned [here](https://doc.rust-lang.org/std/primitive.slice.html#method.get_unchecked).
GitHub Security Advisory: GHSA-q7pg-9pr4-mrp2
Package: httpsig (RUST)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 0.0.19
Patched in: 0.0.19

Summary: httpsig-rs: HMAC verification is vulnerable to timing attack

Details:
### Summary
HMAC signature comparison is not timing-safe and is vulnerable to timing attacks.

### Details
`SharedKey::sign()` returns a `Vec<u8>` which has a non-constant-time equality implementation.

`Hmac::finalize()` returns a constant-time wrapper ([`CtOutput`](https://docs.rs/digest/0.10.7/digest/struct.CtOutput.html)) which was discarded. Alternatively, `Hmac` has a constant-time `verify()` method.

The problem reported here is due to the following lines in `SharedKey::sign()` of the previous code:
```rust
let mut mac = HmacSha256::new_from_slice(key).unwrap();
mac.update(data);
Ok(mac.finalize().into_bytes().to_vec())
```
and the merged update changes the third line to directly verify with `verify_slice`.

### Impact

Anyone who uses HS256 signature verification is vulnerably to Timing Attack that allows the attacker to forge a signature.
GitHub Security Advisory: GHSA-7vm2-j586-vcvc
Package: SurrealDB (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.1.9
Patched in: 2.1.9

Summary: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Details:
`LIVE SELECT` statements are used to capture changes to data within a table in real time. Documents included in `WHERE` conditions and `DELETE` notifications were not properly reduced to respect the querying user's security context. Instead the leaked documents reflect the context of the user triggering the notification.

This allows a record or guest user with permissions to run live query subscriptions on a table to observe unauthorised records within the same table, when another user is altering or deleting these records, bypassing access controls.

### Impact
A record or guest user with permissions to run live query subscriptions on a table is able to observe unauthorised records within the same table, with unauthorised records returned when deleted, or when records matching the WHERE conditions are created, updated, or deleted, by another user. This impacts confidentiality, limited to the table the attacker has access to, and with the data disclosed dependent of the actions taken by other users.

### Patches
A patch has been created for the following versions:

- Versions 2.1.9, 2.2.8 and 2.3.8 and later are not affected by this issue. 
- The first release following v3.0.0-alpha.7 will be patched.

### Workarounds
Assess the impact of users with permissions on table records effectively having full read access to the table, use separate tables if required, with impacts to functionality.
GitHub Security Advisory: GHSA-7vm2-j586-vcvc
Package: SurrealDB (RUST)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.2.0, < 2.2.8
Patched in: 2.2.8

Summary: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Details:
`LIVE SELECT` statements are used to capture changes to data within a table in real time. Documents included in `WHERE` conditions and `DELETE` notifications were not properly reduced to respect the querying user's security context. Instead the leaked documents reflect the context of the user triggering the notification.

This allows a record or guest user with permissions to run live query subscriptions on a table to observe unauthorised records within the same table, when another user is altering or deleting these records, bypassing access controls.

### Impact
A record or guest user with permissions to run live query subscriptions on a table is able to observe unauthorised records within the same table, with unauthorised records returned when deleted, or when records matching the WHERE conditions are created, updated, or deleted, by another user. This impacts confidentiality, limited to the table the attacker has access to, and with the data disclosed dependent of the actions taken by other users.

### Patches
A patch has been created for the following versions:

- Versions 2.1.9, 2.2.8 and 2.3.8 and later are not affected by this issue. 
- The first release following v3.0.0-alpha.7 will be patched.

### Workarounds
Assess the impact of users with permissions on table records effectively having full read access to the table, use separate tables if required, with impacts to functionality.