This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.
cyper(32 total, 1 outdated, 1 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| async-stream | ^0.3 | 0.3.6 | up to date |
| base64 | ^0.22 | 0.23.1 | out of date |
| cfg-if | ^1.0.0 | 1.0.4 | up to date |
| compio | ^0.19.0 | 0.19.2 | up to date |
| compression-codecs | ^0.4 | 0.4.39 | up to date |
| cookie_store | ^0.22 | 0.22.1 | up to date |
| cyper-core | ^0.9.0 | 0.9.0 | up to date |
| cyper-hickory | ^0.1.0 | 0.1.0 | up to date |
| encoding_rs | ^0.8 | 0.8.40 | up to date |
| futures-util | ^0.3.30 | 0.3.34 | up to date |
| h3 | ^0.0.8 | 0.0.8 | up to date |
| hickory-net ⚠️ | ^0.26 | 0.26.2 | maybe insecure |
| hickory-resolver | ^0.26 | 0.26.2 | up to date |
| http | ^1.0.0 | 1.5.0 | up to date |
| http-body-util | ^0.1.0 | 0.1.5 | up to date |
| hyper | ^1.4.1 | 1.11.1 | up to date |
| hyper-util | ^0.1.20 | 0.1.20 | up to date |
| mime | ^0.3 | 0.3.17 | up to date |
| mime_guess | ^2.0 | 2.0.5 | up to date |
| nyquest-interface | ^0.4.0 | 0.4.0 | up to date |
| once_cell | ^1 | 1.21.4 | up to date |
| percent-encoding | ^2.3 | 2.3.2 | up to date |
| rustls-platform-verifier | ^0.7.0 | 0.7.0 | up to date |
| send_wrapper | ^0.6 | 0.6.0 | up to date |
| serde | ^1 | 1.0.229 | up to date |
| serde_json | ^1 | 1.0.151 | up to date |
| serde_urlencoded | ^0.7 | 0.7.1 | up to date |
| socket2 | ^0.6 | 0.6.5 | up to date |
| synchrony | ^0.1 | 0.1.9 | up to date |
| thiserror | ^2 | 2.0.20 | up to date |
| tower-service | ^0.3.2 | 0.3.3 | up to date |
| url | ^2 | 2.5.8 | up to date |
(14 total, 2 outdated, 2 possibly insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| axum | ^0.8.1 | 0.8.9 | up to date |
| brotli | ^8 | 9.0.0 | out of date |
| clap | ^4 | 4.6.6 | up to date |
| compio | ^0.19.0 | 0.19.2 | up to date |
| cookie | ^0.18 | 0.18.2 | up to date |
| cyper-axum | ^0.9.0 | 0.9.0 | up to date |
| flate2 | ^1 | 1.1.10 | up to date |
| futures-channel | ^0.3.29 | 0.3.34 | up to date |
| nyquest | ^0.4.0 | 0.4.0 | up to date |
| rustls ⚠️ | ^0.23.13 | 0.23.44 | maybe insecure |
| serde | ^1 | 1.0.229 | up to date |
| time ⚠️ | ^0.3 | 0.3.55 | maybe insecure |
| tower | ^0.5.1 | 0.5.3 | up to date |
| zstd | ^0.13 | 0.14.0 | out of date |
rustls: rustls network-reachable panic in `Acceptor::accept`A bug introduced in rustls 0.23.13 leads to a panic if the received
TLS ClientHello is fragmented. Only servers that use
rustls::server::Acceptor::accept() are affected.
Servers that use tokio-rustls's LazyConfigAcceptor API are affected.
Servers that use tokio-rustls's TlsAcceptor API are not affected.
Servers that use rustls-ffi's rustls_acceptor_accept API are affected.
time: Denial of Service via Stack ExhaustionWhen user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.
A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.
Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.
hickory-net: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responsesThe NSEC3 closest-encloser proof validation in hickory-net's
DnssecDnsHandle walks from the QNAME up to the SOA owner name, building a
list of candidate encloser names. The iterator used assumes the
QNAME is a descendant of the SOA owner, terminating only when the current
candidate equals the SOA name. When the SOA in a response's authority section
is not an ancestor of the QNAME, the loop stalls at the DNS root and never
terminates, repeatedly calling Name::base_name() and pushing newly allocated
Name and hashed-name entries into the candidate Vec.
The bug is reachable by any caller of DnssecDnsHandle — including the
resolver, recursor, and client — when built with the dnssec-ring or
dnssec-aws-lc-rs feature and configured to perform DNSSEC validation. It is
triggered while validating a NoData or NXDomain response whose authority
section contains an SOA record from a zone other than an ancestor of the
QNAME, on a code path that requires NSEC3 closest-encloser proof. In practice
this can be reached through an insecure CNAME chain that crosses zone
boundaries into a DNSSEC-signed zone returning NoData, but the minimum
condition is just a mismatched SOA owner on a response requiring NSEC3
validation.
A debug_assert_ne!(name, Name::root()) guards the loop body, so debug builds
abort with a panic on the first iteration past the root. Release builds
compile the assertion out and run the loop unbounded, allocating until the
process exhausts available memory (OOM). A reachable upstream attacker who
can return such a response can therefore crash a debug-built validator or
exhaust memory on a release-built one.
We recommend all affected users update to hickory-net 0.26.1 for the fix.