This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate jsonrpsee-client-transport

Dependencies

(17 total, 1 possibly insecure)

CrateRequiredLatestStatus
 base64^0.220.22.1up to date
 futures-channel^0.3.140.3.30up to date
 futures-util^0.3.140.3.30up to date
 gloo-net^0.6.00.6.0up to date
 http^11.1.0up to date
 jsonrpsee-core^0.24.50.24.5up to date
 pin-project^11.1.5up to date
 rustls ⚠️^0.230.23.13maybe insecure
 rustls-pki-types^11.9.0up to date
 rustls-platform-verifier^0.3.10.3.4up to date
 soketto^0.80.8.0up to date
 thiserror^11.0.64up to date
 tokio^1.23.11.40.0up to date
 tokio-rustls^0.260.26.0up to date
 tokio-util^0.70.7.12up to date
 tracing^0.1.340.1.40up to date
 url^2.4.02.5.2up to date

Security Vulnerabilities

rustls: `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network input

RUSTSEC-2024-0336

If a close_notify alert is received during a handshake, complete_io does not terminate.

Callers which do not call complete_io are not affected.

rustls-tokio and rustls-ffi do not call complete_io and are not affected.

rustls::Stream and rustls::StreamOwned types use complete_io and are affected.