Deps.rs

virtual-net 0.7.0

[![dependency status](https://deps.rs/crate/virtual-net/0.7.0/status.svg)](https://deps.rs/crate/virtual-net/0.7.0)

This project contains known security vulnerabilities. Find detailed information at the bottom.

Crate virtual-net

Dependencies

(25 total, 12 outdated, 1 insecure)

CrateRequiredLatestStatus
 anyhow^1.01.0.104up to date
 async-trait^0.10.1.92up to date
 base64^0.210.23.1out of date
 bincode^1.33.0.0out of date
 bytecheck^0.6.80.8.3out of date
 bytes^1.11.12.1up to date
 derivative^22.2.0up to date
 futures-util^0.30.3.34up to date
 hyper^11.11.1up to date
 hyper-tungstenite^0.130.30.0out of date
 hyper-util^0.1.50.1.21up to date
 libc^0.20.2.189up to date
 mio^0.81.2.3out of date
 pin-project-lite^0.2.90.2.17up to date
 rkyv ⚠️^0.7.400.8.18insecure
 serde^1.01.0.229up to date
 smoltcp^0.80.14.0out of date
 socket2^0.40.6.5out of date
 thiserror^12.0.21out of date
 tokio^11.53.1up to date
 tokio-serde^0.80.9.0out of date
 tokio-tungstenite^0.210.30.0out of date
 tokio-util^0.7.80.7.19up to date
 tracing^0.10.1.44up to date
 virtual-mio^0.3.00.704.2out of date

Dev dependencies

(3 total, 1 outdated)

CrateRequiredLatestStatus
 serial_test^2.0.04.0.1out of date
 tokio^11.53.1up to date
 tracing-test^0.20.2.6up to date

Security Vulnerabilities

rkyv: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

RUSTSEC-2026-0235

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice lengths.

Once the first pointer had been validated, later pointers to the same address skipped pointee validation. The safe checked rkyv::access API could consequently return a slice with a forged length, allowing safe indexing to read out of bounds. The same validation bypass was reachable through checked deserialization with rkyv::from_bytes.

Version 0.8.17 includes pointer metadata in shared pointer validation and rejects conflicting metadata. The 0.7 series is also affected but is no longer supported by upstream. Users who process untrusted archives should upgrade to 0.8.17 or later.