Dependencies with known security advisories: ammonia, rustls, h2, ringbuf #281

New Issue

rays · 2026-10-17T15:23:56-07:00

rays commented

2026-10-17 15:23:56 -07:00

First run of cargo deny check advisories (RustSec database, 2026-10-17) finds 10 advisories in the locked dependencies of ipx and ipx-directory:

ammonia 4.1.4, the HTML sanitizer for feed text in both services (#RUSTSEC-2021-0157, RUSTSEC-2021-0158, RUSTSEC-2026-0373): CSS url() escaping, XSS via SVG animateMotion/animateTransform/animateColor, and case-insensitive url matching. Fixed in 4.1.8 / 4.2.4. This one matters most: ammonia is what stands between a publisher's HTML and the page.
rustls 0.23.44, via reqwest and hyper-rustls (RUSTSEC-2026-0285, 0346, 0347, 0348, 0349): TLS 1.3 handshake checks, secrets in Debug, ECH, 1 GiB brotli certificate decompression before authentication, and a key-exchange downgrade. ipx connects to strangers' servers for every feed.
h2 0.4.15, via hyper (RUSTSEC-2026-0258): unbounded empty DATA frames, a denial of service.
ringbuf 0.4.8, via librqbit-utp (RUSTSEC-2026-0293): double free in Consumer::skip/clear.

Shown by: cargo deny check advisories

First run of `cargo deny check advisories` (RustSec database, 2026-10-17) finds 10 advisories in the locked dependencies of ipx and ipx-directory: - **ammonia 4.1.4**, the HTML sanitizer for feed text in both services (#RUSTSEC-2021-0157, RUSTSEC-2021-0158, RUSTSEC-2026-0373): CSS `url()` escaping, XSS via SVG `animateMotion`/`animateTransform`/`animateColor`, and case-insensitive `url` matching. Fixed in 4.1.8 / 4.2.4. This one matters most: ammonia is what stands between a publisher's HTML and the page. - **rustls 0.23.44**, via reqwest and hyper-rustls (RUSTSEC-2026-0285, 0346, 0347, 0348, 0349): TLS 1.3 handshake checks, secrets in Debug, ECH, 1 GiB brotli certificate decompression before authentication, and a key-exchange downgrade. ipx connects to strangers' servers for every feed. - **h2 0.4.15**, via hyper (RUSTSEC-2026-0258): unbounded empty DATA frames, a denial of service. - **ringbuf 0.4.8**, via librqbit-utp (RUSTSEC-2026-0293): double free in `Consumer::skip`/`clear`. Shown by: `cargo deny check advisories`

rays added the bug label 2026-10-17 15:23:56 -07:00

rays referenced this issue from a commit

2026-10-17 15:29:03 -07:00

cargo-deny and cargo-machete: four advisories fixed, three unused dependencies gone (#281, #282)

rays commented

2026-10-17 15:40:11 -07:00

Fixed in 341d880: ammonia 4.2.4, rustls 0.23.46, h2 0.4.20, which clears nine of the ten advisories. ringbuf is left at 0.4.8: its fix is 0.5, which librqbit 9.0.1 (the newest) cannot take, and the double free needs an element whose Drop panics, where librqbit-utp buffers u8. deny.toml ignores RUSTSEC-2026-0293 with that reason; take it out once librqbit moves to ringbuf 0.5. cargo deny check is clean and is in the checks in CLAUDE.md. Deployed in ipx and ipx-directory.

Fixed in 341d880: ammonia 4.2.4, rustls 0.23.46, h2 0.4.20, which clears nine of the ten advisories. ringbuf is left at 0.4.8: its fix is 0.5, which librqbit 9.0.1 (the newest) cannot take, and the double free needs an element whose Drop panics, where librqbit-utp buffers u8. deny.toml ignores RUSTSEC-2026-0293 with that reason; take it out once librqbit moves to ringbuf 0.5. `cargo deny check` is clean and is in the checks in CLAUDE.md. Deployed in ipx and ipx-directory.

rays closed this issue

2026-10-17 15:40:11 -07:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rays/ipx#281