https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T05:14:54.395730+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-10734 bdu:2025-10734 2026-10-13T05:14:54.654684+00:00 bdu:2025-10734 https://cve.radiocsirt.org/vuln/euvd-2026-261424 EUVD-2026-261424 2026-10-13T05:14:54.654725+00:00 EUVD-2026-261424 https://cve.radiocsirt.org/vuln/fkie_cve-2025-5791 fkie_cve-2025-5791 2026-10-13T05:14:54.654748+00:00

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.

 https://cve.radiocsirt.org/vuln/ghsa-m65q-v92h-cm7q GHSA-m65q-v92h-cm7q — users may append `root` to group listings 2026-10-13T05:14:54.654788+00:00

Affected: crates.io: users

Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.

This affects both:

- The supplementary groups of a user - The group access list of the current process

If the caller uses this information for access control, this may lead to privilege escalation.

This crate is not currently maintained, so a patched version is not available.

Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.

## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-5791 msrc_CVE-2025-5791 — Users: `root` appended to group listings 2026-10-13T05:14:54.654833+00:00 msrc_CVE-2025-5791 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15217-1 openSUSE-SU-2025:15217-1 — flake-pilot-3.1.19-1.1 on GA media 2026-10-13T05:14:54.654859+00:00

flake-pilot-3.1.19-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:12359 RHSA-2025:12359 — Red Hat Security Advisory: Red Hat OpenShift sandboxed containers release 2026-10-13T05:14:54.654885+00:00

users: `root` appended to group listings net/http: Request smuggling due to acceptance of invalid chunked data in net/http

 https://cve.radiocsirt.org/vuln/rustsec-2025-0040 RUSTSEC-2025-0040 — `root` appended to group listings 2026-10-13T05:14:54.654912+00:00

Affected: crates.io: users

Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.

This affects both:

- The supplementary groups of a user - The group access list of the current process

If the caller uses this information for access control, this may lead to privilege escalation.

This crate is not currently maintained, so a patched version is not available.

Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.

## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)

 https://cve.radiocsirt.org/vuln/suse-ru-2025:20961-1 SUSE-RU-2025:20961-1 — Recommended update for afterburn 2026-10-13T05:14:54.654951+00:00

Recommended update for afterburn

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-5791 UBUNTU-CVE-2025-5791 2026-10-13T05:14:54.654977+00:00

Affected: Ubuntu:20.04:LTS: rust-users, Ubuntu:22.04:LTS: rust-users, Ubuntu:24.04:LTS: rust-users

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.