Issues

• RUSTSEC-2026-0346: Debug impls for client session values expose TLS secrets

  klobucar/aura#41 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0349: Unauthenticated ServerHello can downgrade later connections to classical key exchange

  klobucar/aura#40 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0348: Brotli certificate decompression can allocate up to 1 GiB before authentication

  klobucar/aura#39 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0338: Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads

  klobucar/aura#38 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0340: Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled

  klobucar/aura#37 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0342: Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto

  klobucar/aura#36 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0339: Unbounded growth of pending connection ID retirements in quinn-proto

  klobucar/aura#35 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0341: Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed

  klobucar/aura#34 · Filter by author github-actions opened on Oct 19, 2026

• RUSTSEC-2026-0331: Panic on Decoding Short Hybrid Keys

  klobucar/aura#33 · Filter by author github-actions opened on Oct 12, 2026

• RUSTSEC-2026-0330: Hybrid Encapsulation from Seed Panics on Short Seed

  klobucar/aura#32 · Filter by author github-actions opened on Oct 12, 2026

• RUSTSEC-2026-0285: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

  klobucar/aura#31 · Filter by author github-actions opened on Sep 21, 2026

• RUSTSEC-2026-0258: h2 unbounded empty DATA frames

  klobucar/aura#30 · Filter by author github-actions opened on Aug 24, 2026

• RUSTSEC-2026-0221: event-listener allows !Send tags to cross thread boundaries via StackSlot

  klobucar/aura#24 · Filter by author github-actions opened on Aug 3, 2026

• RUSTSEC-2026-0210: libcrux-aesgcm Renamed to libcrux-aes

  klobucar/aura#22 · Filter by author github-actions opened on Jul 20, 2026

• RUSTSEC-2026-0207: Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls

  klobucar/aura#21 · Filter by author github-actions opened on Jul 20, 2026

• RUSTSEC-2026-0212: Potentially Incorrect Output of Constant-Time Swap/Select on Aarch64

  klobucar/aura#19 · Filter by author github-actions opened on Jul 20, 2026

• RUSTSEC-2026-0208: Potential Panic in AVX2 SHAKE-256

  klobucar/aura#20 · Filter by author github-actions opened on Jul 20, 2026

• RUSTSEC-2026-0211: Non-constant time Authentication Tag Check in AES-GCM Decryption

  klobucar/aura#18 · Filter by author github-actions opened on Jul 20, 2026

• RUSTSEC-2026-0209: AES-GCM did not enforce limits on AAD length

  klobucar/aura#17 · Filter by author github-actions opened on Jul 20, 2026

• RUSTSEC-2026-0204: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid

  klobucar/aura#16 · Filter by author github-actions opened on Jul 13, 2026

• RUSTSEC-2026-0190: Unsoundness in Error::downcast_mut()

  klobucar/aura#15 · Filter by author github-actions opened on Jul 6, 2026

• RUSTSEC-2026-0185: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

  klobucar/aura#14 · Filter by author github-actions opened on Jun 29, 2026