Most recent entries from osv_rustsec

RUSTSEC-2026-0318 — Sending custom to-device messages may panics

Tue, 29 Sep 2026 12:00:00 +0000

Affected: crates.io: matrix-sdk-crypto

Using the `IdentityBasedStrategy` setting when calling `Device::encrypt_event_raw` or `OlmMachine::encrypt_content_for_devices` may cause a panic if the recipient does not have cross-signing keys.

RUSTSEC-2026-0305 — Use-after-free when XML includes have duplicated entities

Wed, 23 Sep 2026 12:00:00 +0000

Affected: crates.io: librsvg

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error.

While libxml2 is expanding an internal entity, a recursive XInclude can parse another document that declares an entity with the same name. Both parses use the same `XmlState` entity map on the librsvg side. `entity_insert()` replaces the first entry, whose `Drop` implementation calls `xmlFreeNode()`. The outer `xmlCtxtParseEntity()` then keeps using the freed 144-byte `xmlEntity`.

The included parse should not free an entity that the outer parser is still using.

The fix is in commit 8a1b0cd319e9af2d1e9cf878081dd77f227a0504, where librsvg will no longer free xmlEntity pointers that libxml2 is still using.

RUSTSEC-2026-0317 — A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

Tue, 29 Sep 2026 12:00:00 +0000

Affected: crates.io: sheets-diff

Affected versions passed caller-supplied bytes to `calamine`'s `Xlsx::new` without first checking that they were a ZIP archive. `Xlsx::new` tests for password protection on its first line, which parses the input as an OLE/CFB container, and a sector-count field read from the file's own header reaches `Vec::with_capacity` without being checked against the file's actual length. A 512-byte input can therefore request several gigabytes; 9,261,285,372 bytes was measured.

**The oversized allocation is always attempted. Whether it aborts depends on what the allocator can satisfy.** On a large host with overcommit the reservation is granted untouched and the call returns an ordinary "not an xlsx file" error, which looks like a malformed file being correctly rejected. Under a memory limit the same bytes give `memory allocation of N bytes failed` and the process aborts, which is not a `Result` a caller can handle. Containers with a memory limit, small hosts and CI runners are where this lands, so testing on a development machine can wrongly suggest the crate is unaffected.

Every entry point reaches it, not only `compare_bytes`: the path- and reader-based APIs funnel through the same internal open. Neither `Limits::default()` nor `Limits::hardened()` prevents it, because `max_input_bytes` bounds the length of the input while the allocation's size comes from a field inside it.

Fixed in 3.2.0, which declines input that does not begin with the ZIP magic before the parser sees it, remov…

RUSTSEC-2026-0213 — XSS in ammonia via SVG `animate` and `set` animation tags

Tue, 21 Jul 2026 12:00:00 +0000

Affected: crates.io: ammonia

The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it.

```xml <svg xmlns="http://www.w3.org/2000/svg"> <a> <set attributeName="href" to="javascript:alert('SET_XSS')"></set> <text y="30">Click set</text> </a> </svg> ```

Ammonia did not apply attribute filters based on `attributeName`, so the contents of the `to`, `from`, and `values` tags were not sanitized as URLs.

Applications that do not explicitly allow either of these tags should not be affected, since neither are allowed by default.

---

**Discovered by:** [Younghun Ko (@koyokr)](https://github.com/koyokr)

RUSTSEC-2026-0316 — Dynamic record lifting can allocate beyond the hostcall fuel limit