rpm package
opensuse/pijul&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/pijul&distro=openSUSE%20Tumbleweed
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-25541 | Hig | 7.5 | < 1.0.0~beta.23-1.1 | 1.0.0~beta.23-1.1 | Feb 4, 2026 | Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. Whe | |
| CVE-2022-50237 | Med | 5.9 | < 1.0.0~beta.23-1.1 | 1.0.0~beta.23-1.1 | Jul 28, 2025 | The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key. | |
| CVE-2025-3416 | Low | 3.7 | < 1.0.0~beta.23-1.1 | 1.0.0~beta.23-1.1 | Apr 8, 2025 | A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string. | |
| CVE-2023-26964 | Hig | 7.5 | < 1.0.0~beta.5-1.1 | 1.0.0~beta.5-1.1 | Apr 11, 2023 | An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). | |
| CVE-2022-31394 | Hig | 7.5 | < 1.0.0~beta.4-1.1 | 1.0.0~beta.4-1.1 | Feb 21, 2023 | Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. | |
| CVE-2022-24713 | Hig | 7.5 | < 1.0.0~beta.2-1.1 | 1.0.0~beta.2-1.1 | Mar 8, 2022 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane |
- affected < 1.0.0~beta.23-1.1fixed 1.0.0~beta.23-1.1
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. Whe
- affected < 1.0.0~beta.23-1.1fixed 1.0.0~beta.23-1.1
The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
- affected < 1.0.0~beta.23-1.1fixed 1.0.0~beta.23-1.1
A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
- affected < 1.0.0~beta.5-1.1fixed 1.0.0~beta.5-1.1
An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).
- affected < 1.0.0~beta.4-1.1fixed 1.0.0~beta.4-1.1
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
- affected < 1.0.0~beta.2-1.1fixed 1.0.0~beta.2-1.1
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane