Vulnerability Report — rgb-lightning-node
Table of Contents
Rust · rgb-lightning-node
|
|
| Path |
. |
| DB updated |
2026-09-02 |
| Dependencies |
769 |
| Vulnerabilities |
6 |
| Warnings (unmaintained/unsound) |
4 |
Vulnerabilities
| # |
ID |
Package |
Version |
Severity |
Fix |
Title |
| 1 |
RUSTSEC-2026-0258 |
h2 |
0.4.15 |
🟠 high |
>=0.4.16 |
h2 unbounded empty DATA frames |
| 2 |
RUSTSEC-2026-0235 |
rkyv |
0.7.46 |
⚪ unknown |
>=0.8.17 |
Insufficient archive validation can cause out-of-bounds reads in archi |
| 3 |
RUSTSEC-2023-0071 |
rsa |
0.9.10 |
🟡 medium |
❌ |
Marvin Attack: potential key recovery through timing sidechannels |
| 4 |
RUSTSEC-2026-0099 |
rustls-webpki |
0.101.7 |
⚪ unknown |
>=0.103.12, <0.104.0-alpha.1 |
Name constraints were accepted for certificates asserting a wildcard n |
| 5 |
RUSTSEC-2026-0104 |
rustls-webpki |
0.101.7 |
🟠 high |
>=0.103.13, <0.104.0-alpha.1 |
Reachable panic in certificate revocation list parsing |
| 6 |
RUSTSEC-2026-0098 |
rustls-webpki |
0.101.7 |
⚪ unknown |
>=0.103.12, <0.104.0-alpha.1 |
Name constraints for URI names were incorrectly accepted |
Vulnerability details
Package: h2 0.4.15
Fix: >=0.4.16
Aliases: GHSA-q83h-524g-xf6h
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows. Low severity. Patch…
RUSTSEC-2026-0235: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Package: rkyv 0.7.46
Fix: >=0.8.17
Aliases: —
Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but…
RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels
Package: rsa 0.9.10
Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c
Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of `reject.example.co…
RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package: rustls-webpki 0.101.7
Fix: >=0.103.13, <0.104.0-alpha.1, >=0.104.0-alpha.7
Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the `only…
RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
Recommended fixes:
h2 → 0.4.16rkyv → 0.8.17rustls-webpki → 0.103.12,
cargo update -p h2 --precise 0.4.16
cargo update -p rkyv --precise 0.8.17
cargo update -p rustls-webpki --precise 0.103.12,
No fix available (monitor upstream):
Warnings
Unmaintained:
Rust · rln-c-ffi
|
|
| Path |
bindings/c-ffi |
| DB updated |
2026-09-02 |
| Dependencies |
755 |
| Vulnerabilities |
6 |
| Warnings (unmaintained/unsound) |
3 |
Vulnerabilities
| # |
ID |
Package |
Version |
Severity |
Fix |
Title |
| 1 |
RUSTSEC-2026-0258 |
h2 |
0.4.15 |
🟠 high |
>=0.4.16 |
h2 unbounded empty DATA frames |
| 2 |
RUSTSEC-2026-0235 |
rkyv |
0.7.46 |
⚪ unknown |
>=0.8.17 |
Insufficient archive validation can cause out-of-bounds reads in archi |
| 3 |
RUSTSEC-2023-0071 |
rsa |
0.9.10 |
🟡 medium |
❌ |
Marvin Attack: potential key recovery through timing sidechannels |
| 4 |
RUSTSEC-2026-0099 |
rustls-webpki |
0.101.7 |
⚪ unknown |
>=0.103.12, <0.104.0-alpha.1 |
Name constraints were accepted for certificates asserting a wildcard n |
| 5 |
RUSTSEC-2026-0104 |
rustls-webpki |
0.101.7 |
🟠 high |
>=0.103.13, <0.104.0-alpha.1 |
Reachable panic in certificate revocation list parsing |
| 6 |
RUSTSEC-2026-0098 |
rustls-webpki |
0.101.7 |
⚪ unknown |
>=0.103.12, <0.104.0-alpha.1 |
Name constraints for URI names were incorrectly accepted |
Vulnerability details
Package: h2 0.4.15
Fix: >=0.4.16
Aliases: GHSA-q83h-524g-xf6h
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows. Low severity. Patch…
RUSTSEC-2026-0235: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Package: rkyv 0.7.46
Fix: >=0.8.17
Aliases: —
Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but…
RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels
Package: rsa 0.9.10
Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c
Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of `reject.example.co…
RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package: rustls-webpki 0.101.7
Fix: >=0.103.13, <0.104.0-alpha.1, >=0.104.0-alpha.7
Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the `only…
RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
Recommended fixes:
h2 → 0.4.16rkyv → 0.8.17rustls-webpki → 0.103.12,
cargo update -p h2 --precise 0.4.16
cargo update -p rkyv --precise 0.8.17
cargo update -p rustls-webpki --precise 0.103.12,
No fix available (monitor upstream):
Warnings
Unmaintained:
Rust · uniffi-bindgen
|
|
| Path |
bindings/uniffi-bindgen |
| DB updated |
2026-09-02 |
| Dependencies |
72 |
| Vulnerabilities |
0 |
| Warnings (unmaintained/unsound) |
3 |
Warnings
Unmaintained:
Unsound:
| Package |
Version |
Advisory |
anyhow |
1.0.102 |
RUSTSEC-2026-0190: Unsoundness in Error::downcast_mut() |
Rust · rln-wasm-sdk
|
|
| Path |
bindings/wasm-sdk |
| DB updated |
2026-09-02 |
| Dependencies |
332 |
| Vulnerabilities |
0 |
| Warnings (unmaintained/unsound) |
6 |
Warnings
Unmaintained:
Unsound:
| Package |
Version |
Advisory |
anyhow |
1.0.102 |
RUSTSEC-2026-0190: Unsoundness in Error::downcast_mut() |
rand |
0.8.5 |
RUSTSEC-2026-0097: Rand is unsound with a custom logger using rand::rng() |
rand |
0.9.2 |
RUSTSEC-2026-0097: Rand is unsound with a custom logger using rand::rng() |
Rust · rln-migration
|
|
| Path |
migration |
| DB updated |
2026-09-02 |
| Dependencies |
288 |
| Vulnerabilities |
5 |
| Warnings (unmaintained/unsound) |
5 |
Vulnerabilities
| # |
ID |
Package |
Version |
Severity |
Fix |
Title |
| 1 |
RUSTSEC-2026-0007 |
bytes |
1.11.0 |
🔴 critical |
>=1.11.1 |
Integer overflow in BytesMut::reserve |
| 2 |
RUSTSEC-2026-0099 |
rustls-webpki |
0.103.9 |
⚪ unknown |
>=0.103.12, <0.104.0-alpha.1 |
Name constraints were accepted for certificates asserting a wildcard n |
| 3 |
RUSTSEC-2026-0049 |
rustls-webpki |
0.103.9 |
🟠 high |
>=0.103.10 |
CRLs not considered authoritative by Distribution Point due to faulty |
| 4 |
RUSTSEC-2026-0104 |
rustls-webpki |
0.103.9 |
🟠 high |
>=0.103.13, <0.104.0-alpha.1 |
Reachable panic in certificate revocation list parsing |
| 5 |
RUSTSEC-2026-0098 |
rustls-webpki |
0.103.9 |
⚪ unknown |
>=0.103.12, <0.104.0-alpha.1 |
Name constraints for URI names were incorrectly accepted |
Vulnerability details
RUSTSEC-2026-0007: Integer overflow in BytesMut::reserve
Package: bytes 1.11.0
Fix: >=1.11.1
Aliases: CVE-2026-25541, GHSA-434x-w66g-qw3r
In the unique reclaim path of BytesMut::reserve, the condition rs if v_capacity >= new_cap + offset uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing `self.c…
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package: rustls-webpki 0.103.9
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of `reject.example.co…
RUSTSEC-2026-0049: CRLs not considered authoritative by Distribution Point due to faulty matching logic
Package: rustls-webpki 0.103.9
Fix: >=0.103.10
Aliases: GHSA-pwjx-qhcg-rvj4
If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be…
RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package: rustls-webpki 0.103.9
Fix: >=0.103.13, <0.104.0-alpha.1, >=0.104.0-alpha.7
Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the `only…
RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package: rustls-webpki 0.103.9
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
Recommended fixes:
bytes → 1.11.1rustls-webpki → 0.103.12,
cargo update -p bytes --precise 1.11.1
cargo update -p rustls-webpki --precise 0.103.12,
Warnings
Unmaintained:
Unsound:
| Package |
Version |
Advisory |
event-listener |
5.4.1 |
RUSTSEC-2026-0221: event-listener allows !Send tags to cross thread boundar |
rand |
0.8.5 |
RUSTSEC-2026-0097: Rand is unsound with a custom logger using rand::rng() |
Node.js · rgb-lightning-node-wasm-regular-rln-e2e
|
|
| Path |
bindings/wasm-sdk/e2e-specs |
| Vulnerabilities |
0 |
✅ No vulnerabilities found.
Vulnerability Report — rgb-lightning-node
Table of Contents
Rust ·
rgb-lightning-node.Vulnerabilities
h20.4.15>=0.4.16rkyv0.7.46>=0.8.17rsa0.9.10❌rustls-webpki0.101.7>=0.103.12, <0.104.0-alpha.1rustls-webpki0.101.7>=0.103.13, <0.104.0-alpha.1rustls-webpki0.101.7>=0.103.12, <0.104.0-alpha.1Vulnerability details
RUSTSEC-2026-0258: h2 unbounded empty DATA frames
Package:
h20.4.15Fix:
>=0.4.16Aliases: GHSA-q83h-524g-xf6h
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows. Low severity. Patch…
RUSTSEC-2026-0235: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Package:
rkyv0.7.46Fix:
>=0.8.17Aliases: —
Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple
Rc,Arc, or weak pointers that shared a data address but…RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels
Package:
rsa0.9.10Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c
Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package:
rustls-webpki0.101.7Fix:
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of
accept.example.com,*.example.comcould feasibly allow a name of `reject.example.co…RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package:
rustls-webpki0.101.7Fix:
>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [
BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid emptyBIT STRINGappearing in the `only…RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package:
rustls-webpki0.101.7Fix:
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
Recommended fixes:
h2→0.4.16rkyv→0.8.17rustls-webpki→0.103.12,No fix available (monitor upstream):
rsaWarnings
Unmaintained:
bincode1.3.3paste1.0.15proc-macro-error22.0.1rustls-pemfile2.2.0Rust ·
rln-c-ffibindings/c-ffiVulnerabilities
h20.4.15>=0.4.16rkyv0.7.46>=0.8.17rsa0.9.10❌rustls-webpki0.101.7>=0.103.12, <0.104.0-alpha.1rustls-webpki0.101.7>=0.103.13, <0.104.0-alpha.1rustls-webpki0.101.7>=0.103.12, <0.104.0-alpha.1Vulnerability details
RUSTSEC-2026-0258: h2 unbounded empty DATA frames
Package:
h20.4.15Fix:
>=0.4.16Aliases: GHSA-q83h-524g-xf6h
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows. Low severity. Patch…
RUSTSEC-2026-0235: Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Package:
rkyv0.7.46Fix:
>=0.8.17Aliases: —
Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple
Rc,Arc, or weak pointers that shared a data address but…RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels
Package:
rsa0.9.10Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c
Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package:
rustls-webpki0.101.7Fix:
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of
accept.example.com,*.example.comcould feasibly allow a name of `reject.example.co…RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package:
rustls-webpki0.101.7Fix:
>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [
BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid emptyBIT STRINGappearing in the `only…RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package:
rustls-webpki0.101.7Fix:
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
Recommended fixes:
h2→0.4.16rkyv→0.8.17rustls-webpki→0.103.12,No fix available (monitor upstream):
rsaWarnings
Unmaintained:
bincode1.3.3paste1.0.15proc-macro-error22.0.1Rust ·
uniffi-bindgenbindings/uniffi-bindgenWarnings
Unmaintained:
bincode1.3.3paste1.0.15Unsound:
anyhow1.0.102Error::downcast_mut()Rust ·
rln-wasm-sdkbindings/wasm-sdkWarnings
Unmaintained:
bincode1.3.3instant0.1.13instantis unmaintainedpaste1.0.15Unsound:
anyhow1.0.102Error::downcast_mut()rand0.8.5rand::rng()rand0.9.2rand::rng()Rust ·
rln-migrationmigrationVulnerabilities
bytes1.11.0>=1.11.1BytesMut::reserverustls-webpki0.103.9>=0.103.12, <0.104.0-alpha.1rustls-webpki0.103.9>=0.103.10rustls-webpki0.103.9>=0.103.13, <0.104.0-alpha.1rustls-webpki0.103.9>=0.103.12, <0.104.0-alpha.1Vulnerability details
RUSTSEC-2026-0007: Integer overflow in
BytesMut::reservePackage:
bytes1.11.0Fix:
>=1.11.1Aliases: CVE-2026-25541, GHSA-434x-w66g-qw3r
In the unique reclaim path of
BytesMut::reserve, the conditionrs if v_capacity >= new_cap + offsetuses an unchecked addition. Whennew_cap + offsetoverflowsusizein release builds, this condition may incorrectly pass, causing `self.c…RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package:
rustls-webpki0.103.9Fix:
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of
accept.example.com,*.example.comcould feasibly allow a name of `reject.example.co…RUSTSEC-2026-0049: CRLs not considered authoritative by Distribution Point due to faulty matching logic
Package:
rustls-webpki0.103.9Fix:
>=0.103.10Aliases: GHSA-pwjx-qhcg-rvj4
If a certificate had more than one
distributionPoint, then only the firstdistributionPointwould be considered against each CRL'sIssuingDistributionPointdistributionPoint, and then the certificate's subsequentdistributionPoints would be…RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package:
rustls-webpki0.103.9Fix:
>=0.103.13, <0.104.0-alpha.1,>=0.104.0-alpha.7Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [
BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid emptyBIT STRINGappearing in the `only…RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package:
rustls-webpki0.103.9Fix:
>=0.103.12, <0.104.0-alpha.1,>=0.104.0-alpha.6Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
Recommended fixes:
bytes→1.11.1rustls-webpki→0.103.12,Warnings
Unmaintained:
async-std1.13.2instant0.1.13instantis unmaintainedproc-macro-error22.0.1Unsound:
event-listener5.4.1event-listenerallows!Sendtags to cross thread boundarrand0.8.5rand::rng()Node.js ·
rgb-lightning-node-wasm-regular-rln-e2ebindings/wasm-sdk/e2e-specs✅ No vulnerabilities found.