Issues

• RUSTSEC-2026-0459: libsqlite3-sys via C SQLite CVE-2026-119375

  openprx/sylvode#41 · Filter by author github-actions opened on Nov 9, 2026

• RUSTSEC-2026-0381: Bundled root certificates allow trust in distrusted emSign intermediates

  openprx/sylvode#34 · Filter by author github-actions opened on Oct 26, 2026

• RUSTSEC-2026-0378: Panic lowering a host-created component model stream into a guest that expects a different payload type

  openprx/sylvode#33 · Filter by author github-actions opened on Oct 26, 2026

• RUSTSEC-2026-0379: Cranelift backend on aarch64 can jump to incorrect target on large Wasm br_table instruction

  openprx/sylvode#32 · Filter by author github-actions opened on Oct 26, 2026

• RUSTSEC-2026-0382: Certificate verification may accept distrusted intermediates

  openprx/sylvode#31 · Filter by author github-actions opened on Oct 26, 2026

• RUSTSEC-2026-0368: zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

  openprx/sylvode#30 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

  openprx/sylvode#28 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

  openprx/sylvode#29 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0354: Host panic when component call_async is cancelled under some conditions

  openprx/sylvode#27 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0355: Panic viewing component model stream or future as the wrong type

  openprx/sylvode#26 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0357: Out-of-bounds zero-length stream writes can panic

  openprx/sylvode#25 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0356: Panic on erroneous call-to-host from guest realloc call

  openprx/sylvode#24 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0363: Component-model handle tables are capped only per instance and charged to no limit

  openprx/sylvode#23 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0360: Overlapping string transcode in a fused adapter can panic

  openprx/sylvode#22 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0359: Stack overflow dropping a long chain of recursive types

  openprx/sylvode#21 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0353: Panic when invoking an async-lifted function via call

  openprx/sylvode#20 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0362: Wasmtime may not properly enforce async-entrypoint requirement

  openprx/sylvode#19 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0364: Exception tags can cause host data structures to be unaligned

  openprx/sylvode#18 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0361: Panic when pending calls are run after a trap

  openprx/sylvode#17 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0358: Yielding in a component start function can lead to a host panic

  openprx/sylvode#16 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets

  openprx/sylvode#15 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange

  openprx/sylvode#14 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication

  openprx/sylvode#13 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0347: Buffered application data sent to outer server after ECH rejection

  openprx/sylvode#12 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0338: Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

  openprx/sylvode#11 · Filter by author github-actions opened on Oct 19, 2026