https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 02:01:50 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-10734 bdu:2025-10734 https://cve.radiocsirt.org/vuln/bdu:2025-10734 https://cve.radiocsirt.org/vuln/euvd-2026-261424 EUVD-2026-261424 https://cve.radiocsirt.org/vuln/euvd-2026-261424 https://cve.radiocsirt.org/vuln/fkie_cve-2025-5791 <p>A flaw was found in the user&#39;s crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.</p> <p>A flaw was found in the user&#39;s crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-5791 https://cve.radiocsirt.org/vuln/ghsa-m65q-v92h-cm7q <p><strong>Affected:</strong> crates.io: users</p> <p>Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.</p> <p>This affects both:</p> <p>- The supplementary groups of a user - The group access list of the current process</p> <p>If the caller uses this information for access control, this may lead to privilege escalation.</p> <p>This crate is not currently maintained, so a patched version is not available.</p> <p>Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.</p> <p>## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)</p> <p><strong>Affected:</strong> crates.io: users</p> <p>Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.</p> <p>This affects both:</p> <p>- The supplementary groups of a user - The group access list of the current process</p> <p>If the caller uses this information for access control, this may lead to privilege escalation.</p> <p>This crate is not currently maintained, so a patched version is not available.</p> <p>Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.</p> <p>## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)</p> https://cve.radiocsirt.org/vuln/ghsa-m65q-v92h-cm7q https://cve.radiocsirt.org/vuln/msrc_cve-2025-5791 msrc_CVE-2025-5791 https://cve.radiocsirt.org/vuln/msrc_cve-2025-5791 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15217-1 <p>flake-pilot-3.1.19-1.1 on GA media</p> <p>flake-pilot-3.1.19-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15217-1 https://cve.radiocsirt.org/vuln/rhsa-2025:12359 <p>users: `root` appended to group listings net/http: Request smuggling due to acceptance of invalid chunked data in net/http</p> <p>users: `root` appended to group listings net/http: Request smuggling due to acceptance of invalid chunked data in net/http</p> https://cve.radiocsirt.org/vuln/rhsa-2025:12359 https://cve.radiocsirt.org/vuln/rustsec-2025-0040 <p><strong>Affected:</strong> crates.io: users</p> <p>Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.</p> <p>This affects both:</p> <p>- The supplementary groups of a user - The group access list of the current process</p> <p>If the caller uses this information for access control, this may lead to privilege escalation.</p> <p>This crate is not currently maintained, so a patched version is not available.</p> <p>Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.</p> <p>## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)</p> <p><strong>Affected:</strong> crates.io: users</p> <p>Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.</p> <p>This affects both:</p> <p>- The supplementary groups of a user - The group access list of the current process</p> <p>If the caller uses this information for access control, this may lead to privilege escalation.</p> <p>This crate is not currently maintained, so a patched version is not available.</p> <p>Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.</p> <p>## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)</p> https://cve.radiocsirt.org/vuln/rustsec-2025-0040 https://cve.radiocsirt.org/vuln/suse-ru-2025:20961-1 <p>Recommended update for afterburn</p> <p>Recommended update for afterburn</p> https://cve.radiocsirt.org/vuln/suse-ru-2025:20961-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-5791 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: rust-users, Ubuntu:22.04:LTS: rust-users, Ubuntu:24.04:LTS: rust-users</p> <p>A flaw was found in the user&#39;s crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: rust-users, Ubuntu:22.04:LTS: rust-users, Ubuntu:24.04:LTS: rust-users</p> <p>A flaw was found in the user&#39;s crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-5791