https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T02:34:42.268809+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-22895 CVE-2023-22895 2026-10-22T02:34:42.270523+00:00

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem.rs. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

 https://cve.radiocsirt.org/vuln/rustsec-2023-0004 RUSTSEC-2023-0004 — bzip2 Denial of Service (DoS) 2026-10-22T02:34:42.270569+00:00

Affected: crates.io: bzip2

Working with specific payloads can cause a Denial of Service (DoS) vector.

Both `Decompress` and `Compress` implementations can enter into infinite loops given specific payloads entered that trigger it.

The issue is described in great detail in the [bzip2 repository issue](https://github.com/alexcrichton/bzip2-rs/pull/86).

Thanks to bjrjk for finding and providing the patch for the issue and the maintainer responsibly responding to release a fix quickly.

Users who use the crate with untrusted data should update the `bzip2` to 0.4.4.