Issues

• RUSTSEC-2026-0446: Request smuggling through malformed chunked request trailers

  SierraSoftworks/rustak#139 · Filter by author github-actions opened on Nov 7, 2026

• RUSTSEC-2026-0447: Compressed request bodies can exhaust memory before extractor limits apply

  SierraSoftworks/rustak#140 · Filter by author github-actions opened on Nov 7, 2026

• RUSTSEC-2026-0448: Unbounded decompression can exhaust memory and CPU resources

  SierraSoftworks/rustak#138 · Filter by author github-actions opened on Nov 7, 2026

• RUSTSEC-2026-0455: Large-window Brotli bodies bypass decompression memory limits

  SierraSoftworks/rustak#137 · Filter by author github-actions opened on Nov 7, 2026

• RUSTSEC-2026-0400: Use-after-free of a dictionary after a one-shot call on a context with an open stream

  SierraSoftworks/rustak#122 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0399: Use-after-free through init_using_cdict and init_using_ddict

  SierraSoftworks/rustak#121 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0401: Out-of-bounds read in train_from_buffer when sample sizes overflow

  SierraSoftworks/rustak#119 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0396: Seekable reads a NULL or out-of-bounds seek table

  SierraSoftworks/rustak#120 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0402: Heap buffer overflow in CCtx::try_clone on a multithreaded context

  SierraSoftworks/rustak#118 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0406: Use-after-free when changing a multithreaded context with an unfinished frame

  SierraSoftworks/rustak#117 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0404: Double free in DCtx::try_clone

  SierraSoftworks/rustak#116 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0405: Out-of-bounds read with an out-of-range InBuffer::pos

  SierraSoftworks/rustak#115 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0397: OutBuffer::around_pos exposes uninitialized memory

  SierraSoftworks/rustak#114 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0395: Use-after-free with CParameter::StableInBuffer

  SierraSoftworks/rustak#113 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0403: Uninitialized memory exposed when streaming decompression of a legacy frame fails

  SierraSoftworks/rustak#111 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0410: WebAssembly allocator shim corrupts memory on allocation failure

  SierraSoftworks/rustak#112 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0398: Seekable::decompress sets a Vec length beyond its capacity for offsets past the end

  SierraSoftworks/rustak#110 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0391: Data from an abandoned stream leaks into the next stream on a reused context

  SierraSoftworks/rustak#109 · Filter by author github-actions opened on Oct 27, 2026

• RUSTSEC-2026-0387: Multiple timing variability issues in operations intended to be constant-time

  SierraSoftworks/rustak#101 · Filter by author github-actions opened on Oct 25, 2026

• RUSTSEC-2026-0387: Multiple timing variability issues in operations intended to be constant-time

  SierraSoftworks/rustak#100 · Filter by author github-actions opened on Oct 25, 2026

• RUSTSEC-2026-0386: AsyncFd::new and related constructors violate I/O safety

  SierraSoftworks/rustak#99 · Filter by author github-actions opened on Oct 24, 2026

• RUSTSEC-2026-0385: Non-constant-time mask generation and u128 comparisons

  SierraSoftworks/rustak#98 · Filter by author github-actions opened on Oct 24, 2026

• RUSTSEC-2026-0367: Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

  SierraSoftworks/rustak#85 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2026-0368: zip: ZipArchive::extract creates symbolic links whose attacker-controlled targets are outside the destination directory

  SierraSoftworks/rustak#86 · Filter by author github-actions opened on Oct 17, 2026

• RUSTSEC-2026-0369: ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

  SierraSoftworks/rustak#84 · Filter by author github-actions opened on Oct 17, 2026