Deps.rs

r3v3rs3 1.0.2

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate r3v3rs3

Dependencies

(87 total, 25 outdated, 1 insecure)

CrateRequiredLatestStatus
 anyhow^1.0.711.0.104up to date
 arc-swap^1.6.01.9.2up to date
 argon2^0.5.00.6.0out of date
 async-compression^0.4.220.4.48up to date
 async-trait^0.1.710.1.92up to date
 axum^0.8.10.8.9up to date
 axum-extra^0.10.00.12.6out of date
 axum-server^0.7.10.8.0out of date
 backoff^0.4.00.4.0up to date
 base64^0.22.10.23.1out of date
 bytes^1.8.01.12.1up to date
 clap^4.3.114.6.7up to date
 dashmap^6.0.16.2.1up to date
 directories^6.0.06.0.0up to date
 flate2^1.0.261.1.10up to date
 fnv^1.0.71.0.7up to date
 futures^0.3.280.3.34up to date
 globwalk^0.9.10.9.1up to date
 governor^0.8.10.10.4out of date
 h3^0.0.70.0.8out of date
 h3-quinn^0.0.90.0.10out of date
 hex^0.4.30.4.3up to date
 hickory-proto ⚠️^0.24.40.26.3insecure
 hickory-resolver^0.24.10.26.3out of date
 hmac^0.12.10.13.0out of date
 http-body-util^0.1.20.1.5up to date
 httpdate^1.0.31.0.3up to date
 humantime-serde^1.1.11.1.1up to date
 hyper^1.4.11.11.1up to date
 hyper-util^0.1.100.1.20up to date
 include_dir^0.7.30.7.4up to date
 indexmap^2.0.02.14.2up to date
 instant-acme^0.8.50.8.5up to date
 ipnet^2.11.02.12.2up to date
 k8s-openapi^0.28.00.28.0up to date
 kube^4.2.04.2.0up to date
 log^0.4.190.4.34up to date
 mime_guess^2.0.42.0.5up to date
 moka^0.12.160.12.16up to date
 network-interface^2.0.02.0.5up to date
 once_cell^1.18.01.21.4up to date
 percent-encoding^2.3.02.3.2up to date
 phf^0.11.20.14.0out of date
 pin-project-lite^0.2.100.2.17up to date
 pkcs8^0.10.20.11.0out of date
 ppp^2.3.02.3.0up to date
 quinn^0.11.60.11.12up to date
 r3v3rs3-api^0.2.50.2.5up to date
 rand^0.8.50.10.2out of date
 rcgen^0.13.00.14.10out of date
 ring^0.17.140.17.14up to date
 rpassword^7.2.07.5.4up to date
 rustls-native-certs^0.8.00.8.4up to date
 rustls-pemfile^2.0.02.2.0up to date
 sailfish^0.9.00.11.7out of date
 serde^1.0.1711.0.229up to date
 serde_default^0.2.00.2.0up to date
 serde_derive^1.0.1711.0.229up to date
 serde_json^1.0.1021.0.151up to date
 serde_qs^0.14.01.1.3out of date
 sha1^0.10.60.11.0out of date
 sha2^0.10.70.11.0out of date
 shellexpand^3.1.03.1.2up to date
 socket2^0.5.90.6.5out of date
 sqlx^0.8.20.9.0out of date
 subtle^2.6.12.6.1up to date
 tar^0.4.380.4.46up to date
 thiserror^2.0.02.0.20up to date
 time^0.3.360.3.55up to date
 tokio^1.29.11.53.1up to date
 tokio-rustls^0.26.00.26.5up to date
 tokio-stream^0.1.140.1.19up to date
 tokio-util^0.7.140.7.19up to date
 toml^0.8.81.1.6+spec-1.1.0out of date
 toml_edit^0.22.90.25.15+spec-1.1.0out of date
 totp-rs^5.1.06.0.0out of date
 tower-service^0.3.30.3.3up to date
 tower_governor^0.6.00.8.0out of date
 tracing^0.1.370.1.44up to date
 tracing-appender^0.2.20.2.5up to date
 tracing-subscriber^0.3.170.3.23up to date
 url^2.4.02.5.8up to date
 utoipa^5.2.05.5.0up to date
 utoipa-axum^0.2.00.2.0up to date
 utoipa-swagger-ui^9.0.29.0.2up to date
 webpki^0.22.40.22.4up to date
 x509-parser^0.17.00.18.1out of date

Dev dependencies

(6 total, 2 outdated, 1 insecure)

CrateRequiredLatestStatus
 mockito^1.6.11.7.2up to date
 net2^0.2.390.2.39up to date
 reqwest^0.12.10.13.5out of date
 rsa ⚠️^0.9.80.9.10insecure
 serde-saphyr^1.2.01.3.0up to date
 tokio-tungstenite^0.26.00.30.0out of date

Security Vulnerabilities

rsa: Marvin Attack: potential key recovery through timing sidechannels

RUSTSEC-2023-0071

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

No patch is yet available. The crypto-bigint migration (RustCrypto/RSA#394) did not close this. Tracking is RustCrypto/RSA#626 (padding still not constant-time). Implicit rejection work is in RustCrypto/RSA#680; default-path blinding is in RustCrypto/RSA#702.

Still affected as of 2026-09-12: rsa 0.9.10 (latest stable) and rsa 0.10.0-rc.18 (latest). patched = [] is intentional.

Workarounds

Avoid using the rsa crate in settings where attackers can observe timing, for example over the network. Local use on a non-compromised computer is fine.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

hickory-proto: CPU exhaustion during message encoding due to O(n²) name compression

RUSTSEC-2026-0119

During message encoding, hickory-proto's BinEncoder stores pointers to labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>. The name compression logic then searches for matches with a linear scan.

A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.

This is similar to CVE-2024-8508.

We recommend all affected users update to hickory-proto 0.26.1 for the fix.