This project might be open to known security vulnerabilities , which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom .
Crate libp2p-core Dependencies (4 total, all up-to-date)
Crate autonat-example Dependencies (1 total, all up-to-date)
Crate Required Latest Status clap ^4.6.14.6.1up to date
Crate autonatv2 Dependencies (8 total, 4 outdated)
Crate browser-webrtc-example Dependencies (10 total, all up-to-date)
Crate chat-example No external dependencies! 🙌
Crate dcutr-example Dependencies (1 total, all up-to-date)
Crate Required Latest Status clap ^4.6.14.6.1up to date
Crate distributed-key-value-store-example No external dependencies! 🙌
Crate file-sharing-example Dependencies (2 total, all up-to-date)
Crate Required Latest Status serde ^1.01.0.228up to date clap ^4.6.14.6.1up to date
Crate identify-example Dependencies (1 total, all up-to-date)
Crate Required Latest Status tokio ^1.52.31.52.3up to date
Crate ipfs-kad-example Dependencies (2 total, all up-to-date)
Crate Required Latest Status clap ^4.6.14.6.1up to date anyhow ^1.0.1021.0.102up to date
Crate ipfs-private-example Dependencies (1 total, all up-to-date)
Crate Required Latest Status either ^1.161.16.0up to date
Crate metrics-example Dependencies (4 total, 4 outdated)
Crate ping-example No external dependencies! 🙌
Crate relay-server-example Dependencies (2 total, all up-to-date)
Crate Required Latest Status clap ^4.6.14.6.1up to date tokio ^1.52.31.52.3up to date
Crate rendezvous-example No external dependencies! 🙌
Crate stream-example Dependencies (1 total, all up-to-date)
Crate Required Latest Status anyhow ^11.0.102up to date
Crate upnp-example No external dependencies! 🙌
Crate hole-punching-tests Dependencies (5 total, 1 outdated)
Crate Required Latest Status anyhow ^11.0.102up to date redis ^0.24.01.2.2out of date serde ^1.0.2281.0.228up to date serde_json ^1.0.1501.0.150up to date either ^1.16.01.16.0up to date
Crate libp2p-identity Dependencies (11 total, 3 outdated)
Crate Required Latest Status asn1_der ^0.7.60.7.7up to date bs58 ^0.5.10.5.1up to date ed25519-dalek ^2.22.2.0up to date hkdf ^0.12.40.13.0out of date k256 ^0.13.40.13.4up to date multihash ^0.19.50.19.5up to date p256 ^0.130.13.2up to date sec1 ^0.70.8.1out of date serde ^11.0.228up to date sha2 ^0.10.80.11.0out of date zeroize ^1.81.8.2up to date
Dev dependencies (4 total, all up-to-date)
Crate interop-tests Dependencies (12 total, 4 outdated)
Crate libp2p-allow-block-list No external dependencies! 🙌
Crate libp2p-connection-limits No external dependencies! 🙌
Crate gen-proto Dependencies (2 total, all up-to-date)
Crate Required Latest Status prost-build ^0.140.14.3up to date protox ^0.9.10.9.1up to date
Crate keygen Dependencies (5 total, all up-to-date)
Crate Required Latest Status clap ^4.6.14.6.1up to date zeroize ^11.8.2up to date serde ^1.0.2281.0.228up to date serde_json ^1.0.1501.0.150up to date base64 ^0.22.10.22.1up to date
Crate libp2p-memory-connection-limits Dependencies (2 total, 1 outdated)
Crate libp2p-metrics Dependencies (1 total, all up-to-date)
Crate Required Latest Status pin-project ^1.1.131.1.13up to date
Crate multistream-select Dependencies (2 total, all up-to-date)
Dev dependencies (2 total, all up-to-date)
Crate libp2p-peer-store Dev dependencies (1 total, all up-to-date)
Crate Required Latest Status serde_json ^1.0.1501.0.150up to date
Crate prost-codec Dependencies (1 total, 1 possibly insecure)
Crate Required Latest Status bytes ⚠️ ^11.11.1maybe insecure
Crate quickcheck-ext Dependencies (2 total, all up-to-date)
Crate rw-stream-sink Dependencies (2 total, all up-to-date)
Crate libp2p-server Dependencies (5 total, all up-to-date)
Crate Required Latest Status base64 ^0.220.22.1up to date clap ^4.6.14.6.1up to date serde ^11.0.228up to date serde_json ^1.01.0.150up to date zeroize ^11.8.2up to date
Crate libp2p-webrtc-utils Dependencies (4 total, 1 outdated)
Crate Required Latest Status hex ^0.40.4.3up to date serde ^1.01.0.228up to date sha2 ^0.10.80.11.0out of date tinytemplate ^1.21.2.1up to date
Crate libp2p-mplex Dependencies (3 total, all up-to-date)
Crate libp2p-muxer-test-harness Dependencies (1 total, all up-to-date)
Crate libp2p-yamux Dependencies (2 total, all up-to-date)
Crate Required Latest Status either ^11.16.0up to date yamux ^0.13.30.13.10up to date
Crate libp2p-autonat Dependencies (2 total, 1 outdated)
Crate Required Latest Status either ^1.16.01.16.0up to date rand_core ^0.60.10.1out of date
Dev dependencies (1 total, 1 possibly insecure)
Crate libp2p-dcutr Dependencies (1 total, all up-to-date)
Crate Required Latest Status either ^1.16.01.16.0up to date
Crate libp2p-floodsub Dependencies (3 total, all up-to-date)
Crate libp2p-gossipsub Dependencies (9 total, 1 outdated)
Crate libp2p-identify Dependencies (2 total, all up-to-date)
Crate Required Latest Status smallvec ^1.15.11.15.1up to date either ^1.16.01.16.0up to date
Crate libp2p-kad Dependencies (6 total, 1 outdated)
Crate Required Latest Status either ^1.161.16.0up to date fnv ^1.01.0.7up to date sha2 ^0.10.80.11.0out of date smallvec ^1.15.11.15.1up to date uint ^0.100.10.0up to date serde ^1.01.0.228up to date
Crate libp2p-mdns Dependencies (2 total, all up-to-date)
Crate Required Latest Status smallvec ^1.15.11.15.1up to date socket2 ^0.6.30.6.4up to date
Crate libp2p-perf Dependencies (4 total, all up-to-date)
Crate Required Latest Status anyhow ^11.0.102up to date clap ^4.6.14.6.1up to date serde ^1.01.0.228up to date serde_json ^1.01.0.150up to date
Crate libp2p-ping No external dependencies! 🙌
Crate libp2p-relay Dependencies (2 total, all up-to-date)
Crate libp2p-rendezvous Dependencies (1 total, all up-to-date)
Crate Required Latest Status bimap ^0.6.30.6.3up to date
Crate libp2p-request-response Dependencies (4 total, all up-to-date)
Dev dependencies (3 total, all up-to-date)
Crate libp2p-stream No external dependencies! 🙌
Crate libp2p-upnp Dependencies (1 total, all up-to-date)
Crate Required Latest Status igd-next ^0.17.00.17.0up to date
Crate libp2p-swarm-derive Dependencies (3 total, all up-to-date)
Crate Required Latest Status heck ^0.50.5.0up to date quote ^1.01.0.45up to date syn ^2.0.1172.0.117up to date
Crate libp2p-swarm-test Dependencies (1 total, all up-to-date)
Crate Required Latest Status async-trait ^0.1.890.1.89up to date
Crate libp2p-swarm Dependencies (3 total, all up-to-date)
Crate Required Latest Status either ^1.16.01.16.0up to date fnv ^1.01.0.7up to date smallvec ^1.15.11.15.1up to date
Dev dependencies (2 total, all up-to-date)
Crate Required Latest Status either ^1.16.01.16.0up to date trybuild ^1.0.1161.0.116up to date
Crate libp2p-dns Dependencies (2 total, all up-to-date)
Crate libp2p-noise Dependencies (4 total, 1 outdated)
Dev dependencies (1 total, all up-to-date)
Crate libp2p-plaintext Dev dependencies (1 total, all up-to-date)
Crate libp2p-pnet Dependencies (3 total, 2 outdated)
Crate Required Latest Status salsa20 ^0.100.11.0out of date sha3 ^0.100.12.0out of date pin-project ^1.1.131.1.13up to date
Crate libp2p-quic Dependencies (3 total, all up-to-date)
Crate Required Latest Status quinn ^0.11.90.11.9up to date rustls ^0.23.400.23.40up to date socket2 ^0.6.30.6.4up to date
Dev dependencies (1 total, all up-to-date)
Crate Required Latest Status quickcheck ^11.1.0up to date
Crate libp2p-tcp Dependencies (2 total, all up-to-date)
Crate Required Latest Status libc ^0.2.1860.2.186up to date socket2 ^0.6.30.6.4up to date
Crate libp2p-tls Dependencies (4 total, 1 possibly insecure)
Crate libp2p-uds Dev dependencies (1 total, all up-to-date)
Crate Required Latest Status tempfile ^3.273.27.0up to date
Crate libp2p-webrtc-websys Dependencies (5 total, all up-to-date)
Crate libp2p-webrtc Dependencies (5 total, all up-to-date)
Dev dependencies (1 total, all up-to-date)
Crate Required Latest Status quickcheck ^1.1.01.1.0up to date
Crate libp2p-websocket-websys Dependencies (4 total, all up-to-date)
Crate libp2p-websocket Dependencies (6 total, 1 outdated)
Crate libp2p-webtransport-websys Dependencies (4 total, all up-to-date)
Dev dependencies (1 total, all up-to-date)
Crate Required Latest Status multibase ^0.9.20.9.2up to date
Crate webtransport-tests Dependencies (3 total, all up-to-date)
Crate libp2p Dependencies (2 total, all up-to-date)
Crate Required Latest Status either ^1.9.01.16.0up to date pin-project ^1.0.01.1.13up to date
Security Vulnerabilities tracing-subscriber: Logging user input may result in poisoning logs with ANSI escape sequencesRUSTSEC-2025-0055
Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:
Manipulate terminal title bars
Clear screens or modify terminal display
Potentially mislead users through terminal manipulation
In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.
This was patched in PR #3368 to escape ANSI control characters from user input.
bytes: Integer overflow in `BytesMut::reserve`RUSTSEC-2026-0007
In the unique reclaim path of BytesMut::reserve, the condition
if v_capacity >= new_cap + offset
uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB.
This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.
PoC
use bytes::*;
fn main() {
let mut a = BytesMut::from(&b"hello world"[..]);
let mut b = a.split_off(5);
// Ensure b becomes the unique owner of the backing storage
drop(a);
// Trigger overflow in new_cap + offset inside reserve
b.reserve(usize::MAX - 6);
// This call relies on the corrupted cap and may cause UB & HBO
b.put_u8(b'h');
}
Workarounds
Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.
rustls-webpki: Reachable panic in certificate revocation list parsingRUSTSEC-2026-0104
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty
BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
Patched
>=0.103.13, <0.104.0-alpha.1
>=0.104.0-alpha.7
