rust security

A subtle integer overflow in a core bytes buffer implementation has quietly rippled through Rust’s async ecosystem: the Bytes crate’s BytesMut::reserve path can corrupt its internal capacity (cap) when an unchecked addition wraps, allowing subsequent operations to create out‑of‑bounds slices and...

A small, innocuous-looking malformed XML string can crash an XML parser and take a service offline — that’s the practical reality behind CVE-2023-34411, a high‑severity denial‑of‑service vulnerability in the widely used Rust crate xml-rs that affected versions 0.8.9 through 0.8.13 and was fixed...