This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate tsukuyomi-tungstenite

Dependencies

(10 total, 6 outdated, 2 possibly insecure)

CrateRequiredLatestStatus
 base64^0.100.22.0out of date
 failure^0.1.20.1.8up to date
 futures^0.10.3.30out of date
 http ⚠️^0.11.1.0out of date
 log^0.40.4.21up to date
 sha-1^0.80.10.1out of date
 tokio-tungstenite^0.60.21.0out of date
 tsukuyomi^0.5.00.5.3up to date
 tsukuyomi-server^0.2.00.2.0up to date
 tungstenite ⚠️^0.60.21.0out of date

Dev dependencies

(1 total, 1 outdated)

CrateRequiredLatestStatus
 version-sync^0.60.9.5out of date

Security Vulnerabilities

http: Integer Overflow in HeaderMap::reserve() can cause Denial of Service

RUSTSEC-2019-0033

HeaderMap::reserve() used usize::next_power_of_two() to calculate the increased capacity. However, next_power_of_two() silently overflows to 0 if given a sufficiently large number in release mode.

If the map was not empty when the overflow happens, the library will invoke self.grow(0) and start infinite probing. This allows an attacker who controls the argument to reserve() to cause a potential denial of service (DoS).

The flaw was corrected in 0.1.20 release of http crate.

http: HeaderMap::Drain API is unsound

RUSTSEC-2019-0034

tungstenite: Tungstenite allows remote attackers to cause a denial of service

RUSTSEC-2023-0065

The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).