Blame for code/bugfind/bench/items/advisory_attempts.jsonl

{"adv_id": "RUSTSEC-2017-0004", "crate": "base64", "date": "2017-05-03", "url": "https://github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319", "title": "Integer overflow leads to heap-based buffer overflow in encode_config_buf", "categories": [], "affected_functions": [], "bug_class": ["overflow"], "pre_version": "0.5.1", "post_version": "0.5.2", "stage": "diff_safe", "changed_files": ["src/lib.rs"], "changed_lines": 180, "unsafe_in_changed_files": 10, "changed_functions": ["encode_config", "encode_config_buf", "encoded_size"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Nested borrows are not supported yet", "lean_lines": null, "seconds": 2.3, "item_id": "adv-RUSTSEC-2017-0004", "kind": "advisory", "labels": {"buggy": "base64@0.5.1", "reference": "base64@0.5.2"}}
{"adv_id": "RUSTSEC-2018-0004", "crate": "claxon", "date": "2018-08-25", "url": "https://github.com/ruuda/claxon/commit/8f28ec275e412dd3af4f3cda460605512faf332c", "title": "Malicious input could cause uninitialized memory to be exposed", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.3.1", "post_version": "0.3.2", "stage": "strict_safe", "changed_files": ["src/subframe.rs"], "changed_lines": 25, "unsafe_in_changed_files": 0, "changed_functions": ["subframe::decode_residual"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Early returns inside of loops are not supported yet", "lean_lines": null, "seconds": 3.6, "item_id": "adv-RUSTSEC-2018-0004", "kind": "advisory", "labels": {"buggy": "claxon@0.3.1", "reference": "claxon@0.3.2"}}
{"adv_id": "RUSTSEC-2018-0007", "crate": "trust-dns-proto", "date": "2018-10-09", "url": null, "title": "Stack overflow when parsing malicious DNS packet", "categories": [], "affected_functions": [], "bug_class": ["overflow", "dos_loop_or_recursion", "logic"], "pre_version": "0.4.2", "post_version": "0.4.3", "stage": "strict_safe", "changed_files": ["src/rr/domain/name.rs"], "changed_lines": 11, "unsafe_in_changed_files": 0, "changed_functions": ["rr::domain::name::read"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: failed to select a version for the requirement `ring = \"^0.12\"`", "lean_lines": null, "seconds": 1.2, "item_id": "adv-RUSTSEC-2018-0007", "kind": "advisory", "labels": {"buggy": "trust-dns-proto@0.4.2", "reference": "trust-dns-proto@0.4.3"}}
{"adv_id": "RUSTSEC-2019-0004", "crate": "libp2p-core", "date": "2019-05-15", "url": null, "title": "Failure to properly verify ed25519 signatures makes any signature valid", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.7.0", "post_version": "0.7.1", "stage": "strict_safe", "changed_files": ["src/identity/ed25519.rs"], "changed_lines": 22, "unsafe_in_changed_files": 0, "changed_functions": ["identity::ed25519::verify"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: failed to select a version for the requirement `zeroize = \"^0.5\"`", "lean_lines": null, "seconds": 1.2, "item_id": "adv-RUSTSEC-2019-0004", "kind": "advisory", "labels": {"buggy": "libp2p-core@0.7.0", "reference": "libp2p-core@0.7.1"}}
{"adv_id": "RUSTSEC-2019-0007", "crate": "asn1_der", "date": "2019-06-13", "url": "https://github.com/KizzyCode/asn1_der/issues/1", "title": "Processing of maliciously crafted length fields causes memory allocation SIGABRTs", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.6.1", "post_version": "0.6.2", "stage": "strict_safe", "changed_files": ["src/der/value.rs"], "changed_lines": 11, "unsafe_in_changed_files": 0, "changed_functions": ["der::value::deserialize"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": true, "translated": true, "error": null, "lean_lines": 132, "seconds": 7.7, "item_id": "adv-RUSTSEC-2019-0007", "kind": "advisory", "labels": {"buggy": "asn1_der@0.6.1", "reference": "asn1_der@0.6.2"}}
{"adv_id": "RUSTSEC-2020-0001", "crate": "trust-dns-server", "date": "2020-01-06", "url": "https://github.com/bluejekyll/trust-dns/issues/980", "title": "Stack overflow when resolving additional records from MX or SRV null targets", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["overflow", "dos_loop_or_recursion"], "pre_version": "0.18.0", "post_version": "0.18.1", "stage": "strict_safe", "changed_files": ["src/store/file/authority.rs", "src/store/in_memory/authority.rs"], "changed_lines": 4, "unsafe_in_changed_files": 0, "changed_functions": ["store::file::authority::try_from_config", "store::in_memory::authority::inner_lookup_wildcard"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Returns inside of nested loops are not supported yet", "lean_lines": null, "seconds": 41.6, "item_id": "adv-RUSTSEC-2020-0001", "kind": "advisory", "labels": {"buggy": "trust-dns-server@0.18.0", "reference": "trust-dns-server@0.18.1"}}
{"adv_id": "RUSTSEC-2020-0008", "crate": "hyper", "date": "2020-03-19", "url": "https://github.com/hyperium/hyper/issues/1925", "title": "Flaw in hyper allows request smuggling by sending a body in GET requests", "categories": ["format-injection"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.12.33", "post_version": "0.12.34", "stage": "diff_safe", "changed_files": ["src/lib.rs", "src/proto/h1/role.rs"], "changed_lines": 101, "unsafe_in_changed_files": 14, "changed_functions": ["proto::h1::role::set_length"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 13.9, "item_id": "adv-RUSTSEC-2020-0008", "kind": "advisory", "labels": {"buggy": "hyper@0.12.33", "reference": "hyper@0.12.34"}}
{"adv_id": "RUSTSEC-2020-0019", "crate": "tokio-rustls", "date": "2020-05-19", "url": "https://github.com/tokio-rs/tls/pull/14", "title": "tokio-rustls reads may cause excessive memory usage", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.12.2", "post_version": "0.12.3", "stage": "strict_safe", "changed_files": ["src/common/mod.rs"], "changed_lines": 11, "unsafe_in_changed_files": 0, "changed_functions": ["common::handshake", "common::poll_read"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Breaks to outer loops are not supported yet", "lean_lines": null, "seconds": 13.3, "item_id": "adv-RUSTSEC-2020-0019", "kind": "advisory", "labels": {"buggy": "tokio-rustls@0.12.2", "reference": "tokio-rustls@0.12.3"}}
{"adv_id": "RUSTSEC-2020-0024", "crate": "tough", "date": "2020-07-09", "url": "https://github.com/awslabs/tough/commit/c1c950682d765ebc661f70381f947bc28b8b058c", "title": "Improper uniqueness verification of signature threshold", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.7.0", "post_version": "0.7.1", "stage": "strict_safe", "changed_files": ["src/schema/verify.rs"], "changed_lines": 31, "unsafe_in_changed_files": 0, "changed_functions": ["schema::verify::verify_role"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 92.9, "item_id": "adv-RUSTSEC-2020-0024", "kind": "advisory", "labels": {"buggy": "tough@0.7.0", "reference": "tough@0.7.1"}}
{"adv_id": "RUSTSEC-2020-0031", "crate": "tiny_http", "date": "2020-06-16", "url": "https://github.com/tiny-http/tiny-http/issues/173", "title": "HTTP Request smuggling through malformed Transfer Encoding headers", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.6.2", "post_version": "0.6.3", "stage": "strict_safe", "changed_files": ["src/common.rs"], "changed_lines": 23, "unsafe_in_changed_files": 0, "changed_functions": ["common::from_str"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 19.9, "item_id": "adv-RUSTSEC-2020-0031", "kind": "advisory", "labels": {"buggy": "tiny_http@0.6.2", "reference": "tiny_http@0.6.3"}}
{"adv_id": "RUSTSEC-2020-0042", "crate": "stack", "date": "2020-09-24", "url": "https://github.com/arcnmx/stack-rs/issues/4", "title": "Missing check in ArrayVec leads to out-of-bounds write.", "categories": [], "affected_functions": [], "bug_class": ["panic"], "pre_version": "0.3.0", "post_version": "0.3.1", "stage": "diff_safe", "changed_files": ["src/vector.rs"], "changed_lines": 3, "unsafe_in_changed_files": 22, "changed_functions": ["vector::insert"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Raw ptr casts are only supported between pointers to literal types; found: cast<*mut Clause0_Item, *const Clause0_Item>", "lean_lines": null, "seconds": 4.3, "item_id": "adv-RUSTSEC-2020-0042", "kind": "advisory", "labels": {"buggy": "stack@0.3.0", "reference": "stack@0.3.1"}}
{"adv_id": "RUSTSEC-2020-0060", "crate": "futures-task", "date": "2020-09-04", "url": "https://github.com/rust-lang/futures-rs/pull/2206", "title": "futures_task::waker may cause a use-after-free if used on a type that isn't 'static", "categories": ["code-execution", "memory-corruption"], "affected_functions": ["futures_task::waker"], "bug_class": ["other"], "pre_version": "0.3.5", "post_version": "0.3.6", "stage": "diff_safe", "changed_files": ["src/lib.rs", "src/waker.rs"], "changed_lines": 9, "unsafe_in_changed_files": 12, "changed_functions": ["waker::waker"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Detected groups of mixed mutually recursive definitions (such as a type mutually recursive with a function, or a function mutually recursive with a trait implementation):", "lean_lines": null, "seconds": 1.4, "item_id": "adv-RUSTSEC-2020-0060", "kind": "advisory", "labels": {"buggy": "futures-task@0.3.5", "reference": "futures-task@0.3.6"}}
{"adv_id": "RUSTSEC-2020-0069", "crate": "lettre", "date": "2020-11-11", "url": "https://github.com/lettre/lettre/pull/508/commits/bbe7cc5381c5380b54fb8bbb4f77a3725917ff0b", "title": "Argument injection in sendmail transport", "categories": ["code-execution", "file-disclosure"], "affected_functions": ["lettre::sendmail::SendmailTransport::send", "lettre::transport::sendmail::SendmailTransport::send", "lettre::transport::sendmail::SendmailTransport::send_raw"], "bug_class": ["logic"], "pre_version": "0.7.0", "post_version": "0.7.1", "stage": "strict_safe", "changed_files": ["src/sendmail/mod.rs"], "changed_lines": 1, "unsafe_in_changed_files": 0, "changed_functions": ["sendmail::send"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: failed to select a version for the requirement `security-framework = \"^0.1.9\"`", "lean_lines": null, "seconds": 2.4, "item_id": "adv-RUSTSEC-2020-0069", "kind": "advisory", "labels": {"buggy": "lettre@0.7.0", "reference": "lettre@0.7.1"}}
{"adv_id": "RUSTSEC-2020-0103", "crate": "autorand", "date": "2020-12-31", "url": "https://github.com/mersinvald/autorand-rs/issues/5", "title": "`impl Random` on arrays can lead to dropping uninitialized memory", "categories": ["memory-corruption"], "affected_functions": [], "bug_class": ["panic"], "pre_version": "0.1.1", "post_version": "0.2.3", "stage": "diff_safe", "changed_files": ["src/lib.rs"], "changed_lines": 170, "unsafe_in_changed_files": 2, "changed_functions": ["rand_iter", "rand_length_iter", "random"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: 03/Crate.lean:2070:4: warning: declaration uses `sorry`\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2020-0103/Crate.lean:2085:4: warning: declaration uses `sorry`\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2020-0103/Crate.lean:2100:4: warning: declaration uses `sorry`\n", "lean_lines": 2407, "seconds": 14.8, "item_id": "adv-RUSTSEC-2020-0103", "kind": "advisory", "labels": {"buggy": "autorand@0.1.1", "reference": "autorand@0.2.3"}}
{"adv_id": "RUSTSEC-2021-0056", "crate": "openssl-src", "date": "2021-05-01", "url": "https://www.openssl.org/news/secadv/20210325.txt", "title": "CA certificate check bypass with X509_V_FLAG_X509_STRICT", "categories": ["crypto-failure"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "111.14.0+1.1.1j", "post_version": "111.15.0+1.1.1k", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 62, "unsafe_in_changed_files": 0, "changed_functions": ["build", "cmd_make"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 20.4, "item_id": "adv-RUSTSEC-2021-0056", "kind": "advisory", "labels": {"buggy": "openssl-src@111.14.0+1.1.1j", "reference": "openssl-src@111.15.0+1.1.1k"}}
{"adv_id": "RUSTSEC-2021-0066", "crate": "evm-core", "date": "2021-05-11", "url": "https://github.com/rust-blockchain/evm", "title": "Denial of service on EVM execution due to memory over-allocation", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.21.0", "post_version": "0.21.1", "stage": "strict_safe", "changed_files": ["src/memory.rs"], "changed_lines": 4, "unsafe_in_changed_files": 0, "changed_functions": ["memory::set"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: use of deprecated associated function `core::num::<impl usize>::max_value`: replaced by the `MAX` associated constant on this type", "lean_lines": null, "seconds": 20.6, "item_id": "adv-RUSTSEC-2021-0066", "kind": "advisory", "labels": {"buggy": "evm-core@0.21.0", "reference": "evm-core@0.21.1"}}
{"adv_id": "RUSTSEC-2021-0069", "crate": "lettre", "date": "2021-05-22", "url": "https://github.com/lettre/lettre/pull/627/commits/93458d01fed0ec81c0e7b4e98e6f35961356fae2", "title": "SMTP command injection in body", "categories": ["format-injection"], "affected_functions": ["lettre::smtp::SmtpTransport::send", "lettre::transport::smtp::SmtpTransport::send", "lettre::transport::smtp::SmtpTransport::send_raw"], "bug_class": ["other"], "pre_version": "0.9.5", "post_version": "0.9.6", "stage": "strict_safe", "changed_files": ["src/lib.rs", "src/smtp/client/mod.rs"], "changed_lines": 15, "unsafe_in_changed_files": 0, "changed_functions": ["smtp::client::encode"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: failed to run custom build command for `openssl-sys v0.9.58`", "lean_lines": null, "seconds": 1.6, "item_id": "adv-RUSTSEC-2021-0069", "kind": "advisory", "labels": {"buggy": "lettre@0.9.5", "reference": "lettre@0.9.6"}}
{"adv_id": "RUSTSEC-2021-0073", "crate": "prost-types", "date": "2021-07-08", "url": "https://github.com/tokio-rs/prost/issues/438", "title": "Conversion from `prost_types::Timestamp` to `SystemTime` can cause an overflow and panic ", "categories": ["denial-of-service"], "affected_functions": ["prost_types::Timestamp::Into<SystemTime>"], "bug_class": ["overflow", "panic"], "pre_version": "0.7.0", "post_version": "0.8.0", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 284, "unsafe_in_changed_files": 0, "changed_functions": ["from", "normalize"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: USTSEC-2021-0073/Crate.lean:12427:4: error: `prost_types.P.Insts.CoreOpsFunctionFnOnceTupleTT.call_once` has already been declared\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2021-0073/Crate.lean:12434:4: error: maximum number of errors (100; from option `maxErrors`) reached, exiting\n", "lean_lines": 29361, "seconds": 88.3, "item_id": "adv-RUSTSEC-2021-0073", "kind": "advisory", "labels": {"buggy": "prost-types@0.7.0", "reference": "prost-types@0.8.0"}}
{"adv_id": "RUSTSEC-2021-0103", "crate": "molecule", "date": "2021-07-30", "url": "https://github.com/nervosnetwork/molecule/pull/49", "title": "Partial read is incorrect in molecule", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.7.1", "post_version": "0.7.2", "stage": "strict_safe", "changed_files": ["src/prelude.rs"], "changed_lines": 1, "unsafe_in_changed_files": 0, "changed_functions": ["prelude::as_builder"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unexpected", "lean_lines": null, "seconds": 1.3, "item_id": "adv-RUSTSEC-2021-0103", "kind": "advisory", "labels": {"buggy": "molecule@0.7.1", "reference": "molecule@0.7.2"}}
{"adv_id": "RUSTSEC-2021-0119", "crate": "nix", "date": "2021-09-27", "url": "https://github.com/nix-rust/nix/issues/1541", "title": "Out-of-bounds write in nix::unistd::getgrouplist", "categories": ["memory-corruption"], "affected_functions": ["nix::unistd::getgrouplist"], "bug_class": ["panic"], "pre_version": "0.20.1", "post_version": "0.20.2", "stage": "diff_safe", "changed_files": ["src/unistd.rs"], "changed_lines": 4, "unsafe_in_changed_files": 188, "changed_functions": ["unistd::getgrouplist"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: rule #6 of macro `libc_enum` is never used", "lean_lines": null, "seconds": 4.8, "item_id": "adv-RUSTSEC-2021-0119", "kind": "advisory", "labels": {"buggy": "nix@0.20.1", "reference": "nix@0.20.2"}}
{"adv_id": "RUSTSEC-2021-0129", "crate": "openssl-src", "date": "2021-12-14", "url": "https://www.openssl.org/news/secadv/20211214.txt", "title": "Invalid handling of `X509_verify_cert()` internal errors in libssl", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["dos_loop_or_recursion", "logic"], "pre_version": "300.0.3+3.0.0", "post_version": "300.0.4+3.0.1", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 1, "unsafe_in_changed_files": 0, "changed_functions": ["build"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 23.2, "item_id": "adv-RUSTSEC-2021-0129", "kind": "advisory", "labels": {"buggy": "openssl-src@300.0.3+3.0.0", "reference": "openssl-src@300.0.4+3.0.1"}}
{"adv_id": "RUSTSEC-2021-0143", "crate": "kamadak-exif", "date": "2021-01-04", "url": "https://github.com/kamadak/exif-rs/commit/1b05eab57e484cd7d576d4357b9cda7fdc57df8c", "title": "kamadak-exif DoS with untrusted PNG data", "categories": ["denial-of-service"], "affected_functions": ["kamadak_exif::Reader::read_from_container"], "bug_class": ["dos_loop_or_recursion"], "pre_version": "0.5.2", "post_version": "0.5.3", "stage": "strict_safe", "changed_files": ["src/png.rs", "src/util.rs"], "changed_lines": 40, "unsafe_in_changed_files": 0, "changed_functions": ["png::get_exif_attr_sub", "util::discard_exact"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Dynamic trait types are not supported yet", "lean_lines": null, "seconds": 5.0, "item_id": "adv-RUSTSEC-2021-0143", "kind": "advisory", "labels": {"buggy": "kamadak-exif@0.5.2", "reference": "kamadak-exif@0.5.3"}}
{"adv_id": "RUSTSEC-2021-0158", "crate": "ammonia", "date": "2021-10-10", "url": "https://github.com/rust-ammonia/ammonia/pull/261", "title": "XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags", "categories": ["format-injection"], "affected_functions": [], "bug_class": ["other"], "pre_version": "4.1.6", "post_version": "4.1.7", "stage": "strict_safe", "changed_files": ["src/style.rs"], "changed_lines": 9, "unsafe_in_changed_files": 0, "changed_functions": ["style::parse_value"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 53.5, "item_id": "adv-RUSTSEC-2021-0158", "kind": "advisory", "labels": {"buggy": "ammonia@4.1.6", "reference": "ammonia@4.1.7"}}
{"adv_id": "RUSTSEC-2022-0006", "crate": "thread_local", "date": "2022-01-23", "url": "https://github.com/Amanieu/thread_local-rs/issues/33", "title": "Data race in `Iter` and `IterMut`", "categories": ["memory-corruption"], "affected_functions": [], "bug_class": ["other"], "pre_version": "1.1.3", "post_version": "1.1.4", "stage": "diff_safe", "changed_files": ["src/lib.rs"], "changed_lines": 2, "unsafe_in_changed_files": 38, "changed_functions": ["next"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Returns inside of nested loops are not supported yet", "lean_lines": null, "seconds": 3.6, "item_id": "adv-RUSTSEC-2022-0006", "kind": "advisory", "labels": {"buggy": "thread_local@1.1.3", "reference": "thread_local@1.1.4"}}
{"adv_id": "RUSTSEC-2022-0018", "crate": "totp-rs", "date": "2022-05-09", "url": "https://github.com/constantoine/totp-rs/issues/13", "title": "Timing attack", "categories": ["crypto-failure"], "affected_functions": ["totp_rs::TOTP::check"], "bug_class": ["other"], "pre_version": "1.0.0", "post_version": "1.1.0", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 67, "unsafe_in_changed_files": 0, "changed_functions": ["check", "sign"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon timeout", "lean_lines": null, "seconds": 300.1, "item_id": "adv-RUSTSEC-2022-0018", "kind": "advisory", "labels": {"buggy": "totp-rs@1.0.0", "reference": "totp-rs@1.1.0"}}
{"adv_id": "RUSTSEC-2022-0025", "crate": "openssl-src", "date": "2022-05-03", "url": "https://www.openssl.org/news/secadv/20220503.txt", "title": "Resource leakage when decoding certificates and keys", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "300.0.5+3.0.2", "post_version": "300.0.6+3.0.3", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 5, "unsafe_in_changed_files": 0, "changed_functions": ["build"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 24.2, "item_id": "adv-RUSTSEC-2022-0025", "kind": "advisory", "labels": {"buggy": "openssl-src@300.0.5+3.0.2", "reference": "openssl-src@300.0.6+3.0.3"}}
{"adv_id": "RUSTSEC-2022-0028", "crate": "neon", "date": "2022-05-22", "url": "https://github.com/neon-bindings/neon/issues/896", "title": "Use after free in Neon external buffers", "categories": ["memory-corruption", "memory-exposure"], "affected_functions": ["neon::types::JsArrayBuffer::external", "neon::types::JsBuffer::external"], "bug_class": ["panic", "logic"], "pre_version": "0.10.0", "post_version": "0.10.1", "stage": "diff_safe", "changed_files": ["src/types/buffer/types.rs"], "changed_lines": 4, "unsafe_in_changed_files": 48, "changed_functions": ["types::buffer::types::external"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 73.3, "item_id": "adv-RUSTSEC-2022-0028", "kind": "advisory", "labels": {"buggy": "neon@0.10.0", "reference": "neon@0.10.1"}}
{"adv_id": "RUSTSEC-2022-0059", "crate": "openssl-src", "date": "2022-10-11", "url": "https://www.openssl.org/news/secadv/20221011.txt", "title": "Using a Custom Cipher with `NID_undef` may lead to NULL encryption", "categories": ["crypto-failure"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "300.0.9+3.0.5", "post_version": "300.0.11+3.0.7", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 7, "unsafe_in_changed_files": 0, "changed_functions": ["build"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 25.0, "item_id": "adv-RUSTSEC-2022-0059", "kind": "advisory", "labels": {"buggy": "openssl-src@300.0.9+3.0.5", "reference": "openssl-src@300.0.11+3.0.7"}}
{"adv_id": "RUSTSEC-2022-0062", "crate": "matrix-sdk", "date": "2022-10-24", "url": "https://github.com/matrix-org/matrix-rust-sdk/issues/1110", "title": "matrix-sdk 0.6.0 logs access tokens", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.6.1", "post_version": "0.6.2", "stage": "strict_safe", "changed_files": ["src/config/sync.rs"], "changed_lines": 1, "unsafe_in_changed_files": 0, "changed_functions": ["config::sync::fmt"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 278.1, "item_id": "adv-RUSTSEC-2022-0062", "kind": "advisory", "labels": {"buggy": "matrix-sdk@0.6.1", "reference": "matrix-sdk@0.6.2"}}
{"adv_id": "RUSTSEC-2022-0088", "crate": "tauri", "date": "2022-08-07", "url": "https://github.com/tauri-apps/tauri/issues/4882", "title": "`tauri`'s `readDir` endpoint allows possible enumeration outside of filesystem scope", "categories": ["privilege-escalation"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "1.0.5", "post_version": "1.0.6", "stage": "diff_safe", "changed_files": ["src/api/dir.rs", "src/api/file.rs", "src/endpoints/file_system.rs"], "changed_lines": 58, "unsafe_in_changed_files": 4, "changed_functions": ["api::dir::is_dir", "api::dir::read_dir", "endpoints::file_system::read_dir"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: failed to run custom build command for `gdk-sys v0.15.1`", "lean_lines": null, "seconds": 23.7, "item_id": "adv-RUSTSEC-2022-0088", "kind": "advisory", "labels": {"buggy": "tauri@1.0.5", "reference": "tauri@1.0.6"}}
{"adv_id": "RUSTSEC-2023-0001", "crate": "tokio", "date": "2023-01-04", "url": "https://github.com/tokio-rs/tokio/pull/5336", "title": "reject_remote_clients Configuration corruption", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "1.18.3", "post_version": "1.18.4", "stage": "diff_safe", "changed_files": ["src/net/windows/named_pipe.rs"], "changed_lines": 54, "unsafe_in_changed_files": 34, "changed_functions": ["net::windows::named_pipe::named_pipe_info", "net::windows::named_pipe::pipe_mode"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 4316, "seconds": 9.6, "item_id": "adv-RUSTSEC-2023-0001", "kind": "advisory", "labels": {"buggy": "tokio@1.18.3", "reference": "tokio@1.18.4"}}
{"adv_id": "RUSTSEC-2023-0004", "crate": "bzip2", "date": "2023-01-09", "url": "https://github.com/alexcrichton/bzip2-rs/pull/86", "title": "bzip2 Denial of Service (DoS)", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["dos_loop_or_recursion"], "pre_version": "0.4.3", "post_version": "0.4.4", "stage": "diff_safe", "changed_files": ["src/mem.rs"], "changed_lines": 8, "unsafe_in_changed_files": 24, "changed_functions": ["mem::compress", "mem::decompress"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Arrow types are not supported yet", "lean_lines": null, "seconds": 4.9, "item_id": "adv-RUSTSEC-2023-0004", "kind": "advisory", "labels": {"buggy": "bzip2@0.4.3", "reference": "bzip2@0.4.4"}}
{"adv_id": "RUSTSEC-2023-0006", "crate": "openssl-src", "date": "2023-02-07", "url": "https://www.openssl.org/news/secadv/20230207.txt", "title": "X.400 address type confusion in X.509 `GeneralName`", "categories": ["denial-of-service", "memory-exposure"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "111.24.0+1.1.1s", "post_version": "111.25.0+1.1.1t", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 1, "unsafe_in_changed_files": 0, "changed_functions": ["build"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 22.2, "item_id": "adv-RUSTSEC-2023-0006", "kind": "advisory", "labels": {"buggy": "openssl-src@111.24.0+1.1.1s", "reference": "openssl-src@111.25.0+1.1.1t"}}
{"adv_id": "RUSTSEC-2023-0030", "crate": "versionize", "date": "2023-03-24", "url": "https://github.com/firecracker-microvm/versionize/pull/53", "title": "`Versionize::deserialize` implementation for `FamStructWrapper<T>` is lacking bound checks, potentially leading to out of bounds memory accesses ", "categories": ["memory-exposure"], "affected_functions": [], "bug_class": ["overflow", "panic"], "pre_version": "0.1.9", "post_version": "0.1.10", "stage": "diff_safe", "changed_files": ["src/primitives.rs"], "changed_lines": 14, "unsafe_in_changed_files": 2, "changed_functions": ["primitives::deserialize"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 28.4, "item_id": "adv-RUSTSEC-2023-0030", "kind": "advisory", "labels": {"buggy": "versionize@0.1.9", "reference": "versionize@0.1.10"}}
{"adv_id": "RUSTSEC-2023-0038", "crate": "sequoia-openpgp", "date": "2023-05-16", "url": "https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/", "title": "Out-of-bounds array access leads to panic", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["panic"], "pre_version": "1.1.0", "post_version": "1.1.1", "stage": "diff_safe", "changed_files": ["src/armor.rs", "src/parse.rs", "src/parse/hashed_reader.rs", "src/parse/map.rs", "src/parse/stream.rs"], "changed_lines": 130, "unsafe_in_changed_files": 4, "changed_functions": ["parse::hashed_reader::hash_update_csf", "parse::map::new", "parse::stream::push_signature"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: failed to run custom build command for `clang-sys v1.1.1`", "lean_lines": null, "seconds": 10.3, "item_id": "adv-RUSTSEC-2023-0038", "kind": "advisory", "labels": {"buggy": "sequoia-openpgp@1.1.0", "reference": "sequoia-openpgp@1.1.1"}}
{"adv_id": "RUSTSEC-2023-0039", "crate": "buffered-reader", "date": "2023-05-16", "url": "https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/", "title": "Out-of-bounds array access leads to panic", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["panic"], "pre_version": "1.0.1", "post_version": "1.0.2", "stage": "strict_safe", "changed_files": ["src/generic.rs"], "changed_lines": 37, "unsafe_in_changed_files": 0, "changed_functions": ["generic::data_helper"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Dynamic trait types are not supported yet", "lean_lines": null, "seconds": 12.6, "item_id": "adv-RUSTSEC-2023-0039", "kind": "advisory", "labels": {"buggy": "buffered-reader@1.0.1", "reference": "buffered-reader@1.0.2"}}
{"adv_id": "RUSTSEC-2023-0041", "crate": "trust-dns-server", "date": "2023-06-01", "url": "https://github.com/bluejekyll/trust-dns/pull/1952", "title": "Remote Attackers can cause Denial-of-Service (packet loops) with crafted DNS packets", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.22.0", "post_version": "0.22.1", "stage": "diff_safe", "changed_files": ["src/server/server_future.rs"], "changed_lines": 7, "unsafe_in_changed_files": 2, "changed_functions": ["server::server_future::handle_request"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Found type error in the output of charon", "lean_lines": null, "seconds": 43.7, "item_id": "adv-RUSTSEC-2023-0041", "kind": "advisory", "labels": {"buggy": "trust-dns-server@0.22.0", "reference": "trust-dns-server@0.22.1"}}
{"adv_id": "RUSTSEC-2023-0065", "crate": "tungstenite", "date": "2023-09-25", "url": "https://github.com/snapview/tungstenite-rs/issues/376", "title": "Tungstenite allows remote attackers to cause a denial of service", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.20.0", "post_version": "0.20.1", "stage": "strict_safe", "changed_files": ["src/error.rs", "src/handshake/machine.rs"], "changed_lines": 88, "unsafe_in_changed_files": 0, "changed_functions": ["handshake::machine::single_round", "handshake::machine::start_read", "handshake::machine::try_parse"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] The input arguments don't have the proper type", "lean_lines": null, "seconds": 13.2, "item_id": "adv-RUSTSEC-2023-0065", "kind": "advisory", "labels": {"buggy": "tungstenite@0.20.0", "reference": "tungstenite@0.20.1"}}
{"adv_id": "RUSTSEC-2023-0073", "crate": "candid", "date": "2023-12-08", "url": "https://github.com/dfinity/candid/pull/478", "title": "Infinite decoding loop through specially crafted payload", "categories": ["denial-of-service"], "affected_functions": ["candid::Decode"], "bug_class": ["logic"], "pre_version": "0.9.9", "post_version": "0.9.10", "stage": "diff_safe", "changed_files": ["src/de.rs", "src/types/value.rs"], "changed_lines": 9, "unsafe_in_changed_files": 2, "changed_functions": ["de::deserialize_empty", "types::value::visit_byte_buf"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 377, "seconds": 144.1, "item_id": "adv-RUSTSEC-2023-0073", "kind": "advisory", "labels": {"buggy": "candid@0.9.9", "reference": "candid@0.9.10"}}
{"adv_id": "RUSTSEC-2023-0080", "crate": "transpose", "date": "2023-12-18", "url": "https://github.com/ejmahler/transpose/issues/11", "title": "Buffer overflow due to integer overflow in `transpose`", "categories": ["memory-corruption"], "affected_functions": ["transpose::transpose"], "bug_class": ["overflow", "panic"], "pre_version": "0.2.2", "post_version": "0.2.3", "stage": "diff_safe", "changed_files": ["src/in_place.rs", "src/out_of_place.rs"], "changed_lines": 16, "unsafe_in_changed_files": 24, "changed_functions": ["in_place::multiplicative_inverse", "in_place::transpose_inplace", "out_of_place::transpose"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 20.0, "item_id": "adv-RUSTSEC-2023-0080", "kind": "advisory", "labels": {"buggy": "transpose@0.2.2", "reference": "transpose@0.2.3"}}
{"adv_id": "RUSTSEC-2023-0082", "crate": "phonenumber", "date": "2023-09-19", "url": "https://github.com/whisperfish/rust-phonenumber/commit/2dd44be94539c051b4dee55d1d9d349bd7bedde6", "title": "phonenumber:  panic on parsing crafted RF3966 phonenumber inputs ", "categories": ["denial-of-service"], "affected_functions": ["phonenumber::parse"], "bug_class": ["panic", "logic"], "pre_version": "0.2.4+8.11.3", "post_version": "0.2.5+8.11.3", "stage": "strict_safe", "changed_files": ["src/parser/mod.rs", "src/parser/rfc3966.rs"], "changed_lines": 13, "unsafe_in_changed_files": 0, "changed_functions": ["parser::rfc3966::phone_number"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error[E0308]: mismatched types", "lean_lines": null, "seconds": 15.4, "item_id": "adv-RUSTSEC-2023-0082", "kind": "advisory", "labels": {"buggy": "phonenumber@0.2.4+8.11.3", "reference": "phonenumber@0.2.5+8.11.3"}}
{"adv_id": "RUSTSEC-2023-0095", "crate": "odoh-rs", "date": "2023-08-03", "url": "https://github.com/cloudflare/odoh-rs/pull/28", "title": "Invalid Slice Split Results in Server Panic", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["panic", "logic"], "pre_version": "1.0.1", "post_version": "1.0.2", "stage": "strict_safe", "changed_files": ["src/protocol.rs"], "changed_lines": 22, "unsafe_in_changed_files": 0, "changed_functions": ["protocol::decrypt_query"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error[E0635]: unknown feature `proc_macro_span_shrink`", "lean_lines": null, "seconds": 2.2, "item_id": "adv-RUSTSEC-2023-0095", "kind": "advisory", "labels": {"buggy": "odoh-rs@1.0.1", "reference": "odoh-rs@1.0.2"}}
{"adv_id": "RUSTSEC-2023-0096", "crate": "aes-gcm", "date": "2023-11-22", "url": "https://github.com/RustCrypto/AEADs/pull/551", "title": "Plaintext exposed in decrypt_in_place_detached even on tag verification failure", "categories": ["crypto-failure"], "affected_functions": ["aes_gcm::AeadInPlace::decrypt_in_place_detached", "aes_gcm::AesGcm::decrypt_in_place_detached"], "bug_class": ["other"], "pre_version": "0.10.2", "post_version": "0.10.3", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 2, "unsafe_in_changed_files": 0, "changed_functions": ["decrypt_in_place_detached"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: 96/Crate.lean:4743:4: warning: declaration uses `sorry`\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2023-0096/Crate.lean:4795:2: warning: declaration uses `sorry`\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2023-0096/Crate.lean:4826:2: warning: declaration uses `sorry`\n", "lean_lines": 4894, "seconds": 39.2, "item_id": "adv-RUSTSEC-2023-0096", "kind": "advisory", "labels": {"buggy": "aes-gcm@0.10.2", "reference": "aes-gcm@0.10.3"}}
{"adv_id": "RUSTSEC-2024-0008", "crate": "trillium-client", "date": "2024-01-23", "url": "https://github.com/trillium-rs/trillium/commit/16a42b3f8378a3fa4e61ece3e3e37e6a530df51d", "title": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.5.3", "post_version": "0.5.4", "stage": "strict_safe", "changed_files": ["src/conn.rs"], "changed_lines": 17, "unsafe_in_changed_files": 0, "changed_functions": ["conn::build_head"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: unnecessary qualification", "lean_lines": null, "seconds": 13.3, "item_id": "adv-RUSTSEC-2024-0008", "kind": "advisory", "labels": {"buggy": "trillium-client@0.5.3", "reference": "trillium-client@0.5.4"}}
{"adv_id": "RUSTSEC-2024-0011", "crate": "snow", "date": "2024-01-23", "url": "https://github.com/mcginty/snow/commit/12e8ae55547ae297d5f70599e5c884ea891303eb", "title": "Unauthenticated Nonce Increment in snow", "categories": ["crypto-failure", "denial-of-service"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.9.4", "post_version": "0.9.5", "stage": "strict_safe", "changed_files": ["src/cipherstate.rs", "src/resolvers/default.rs"], "changed_lines": 11, "unsafe_in_changed_files": 0, "changed_functions": ["cipherstate::decrypt_ad"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error[E0635]: unknown feature `stdsimd`", "lean_lines": null, "seconds": 7.9, "item_id": "adv-RUSTSEC-2024-0011", "kind": "advisory", "labels": {"buggy": "snow@0.9.4", "reference": "snow@0.9.5"}}
{"adv_id": "RUSTSEC-2024-0021", "crate": "eyre", "date": "2024-03-05", "url": "https://github.com/eyre-rs/eyre/issues/141", "title": "Parts of Report are dropped as the wrong type during downcast", "categories": ["memory-corruption"], "affected_functions": ["eyre::Report::downcast"], "bug_class": ["overflow", "logic"], "pre_version": "0.6.11", "post_version": "0.6.12", "stage": "diff_safe", "changed_files": ["src/error.rs", "src/lib.rs", "src/option.rs"], "changed_lines": 13, "unsafe_in_changed_files": 116, "changed_functions": ["error::context_drop_rest", "option::ok_or_eyre"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Early returns inside of loops are not supported yet", "lean_lines": null, "seconds": 3.7, "item_id": "adv-RUSTSEC-2024-0021", "kind": "advisory", "labels": {"buggy": "eyre@0.6.11", "reference": "eyre@0.6.12"}}
{"adv_id": "RUSTSEC-2024-0335", "crate": "gix-transport", "date": "2024-04-13", "url": "https://github.com/Byron/gitoxide/pull/1032", "title": "gix-transport indirect code execution via malicious username", "categories": ["code-execution"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.41.2", "post_version": "0.42.0", "stage": "strict_safe", "changed_files": ["src/client/blocking_io/file.rs", "src/client/blocking_io/ssh/mod.rs", "src/client/blocking_io/ssh/program_kind.rs", "src/client/blocking_io/ssh/tests.rs"], "changed_lines": 130, "unsafe_in_changed_files": 0, "changed_functions": ["client::blocking_io::file::configure", "client::blocking_io::ssh::connect", "client::blocking_io::ssh::program_kind::prepare_invocation"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 3110, "seconds": 23.5, "item_id": "adv-RUSTSEC-2024-0335", "kind": "advisory", "labels": {"buggy": "gix-transport@0.41.2", "reference": "gix-transport@0.42.0"}}
{"adv_id": "RUSTSEC-2024-0357", "crate": "openssl", "date": "2024-07-21", "url": "https://github.com/sfackler/rust-openssl/pull/2266", "title": "`MemBio::get_buf` has undefined behavior with empty buffers", "categories": [], "affected_functions": ["openssl::bio::MemBio::get_buf"], "bug_class": ["panic"], "pre_version": "0.10.65", "post_version": "0.10.66", "stage": "diff_safe", "changed_files": ["src/bio.rs"], "changed_lines": 17, "unsafe_in_changed_files": 14, "changed_functions": ["bio::BIO_new_mem_buf", "bio::get_buf"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unsupported operation: &raw mut (*_6)", "lean_lines": null, "seconds": 9.8, "item_id": "adv-RUSTSEC-2024-0357", "kind": "advisory", "labels": {"buggy": "openssl@0.10.65", "reference": "openssl@0.10.66"}}
{"adv_id": "RUSTSEC-2024-0366", "crate": "cosmwasm-vm", "date": "2024-08-27", "url": "https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2023-004.md", "title": "CWA-2023-004: Excessive number of function parameters in compiled Wasm", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["other"], "pre_version": "1.2.7", "post_version": "1.2.8", "stage": "diff_safe", "changed_files": ["src/compatibility.rs", "src/modules/file_system_cache.rs"], "changed_lines": 66, "unsafe_in_changed_files": 12, "changed_functions": ["compatibility::check_wasm", "compatibility::check_wasm_capabilities", "modules::file_system_cache::store"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error[E0635]: unknown feature `stdsimd`", "lean_lines": null, "seconds": 10.7, "item_id": "adv-RUSTSEC-2024-0366", "kind": "advisory", "labels": {"buggy": "cosmwasm-vm@1.2.7", "reference": "cosmwasm-vm@1.2.8"}}
{"adv_id": "RUSTSEC-2024-0369", "crate": "phonenumber", "date": "2024-07-07", "url": "https://github.com/whisperfish/rust-phonenumber/issues/69", "title": "phonenumber:  panic on parsing crafted phonenumber inputs", "categories": ["denial-of-service"], "affected_functions": ["phonenumber::parse"], "bug_class": ["panic", "logic"], "pre_version": "0.3.5+8.13.36", "post_version": "0.3.6+8.13.36", "stage": "strict_safe", "changed_files": ["src/national_number.rs", "src/parser/mod.rs", "src/phone_number.rs"], "changed_lines": 46, "unsafe_in_changed_files": 0, "changed_functions": ["national_number::new", "parser::phone_number"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented: found an occurrence of a lifetime constraint relating", "lean_lines": null, "seconds": 29.5, "item_id": "adv-RUSTSEC-2024-0369", "kind": "advisory", "labels": {"buggy": "phonenumber@0.3.5+8.13.36", "reference": "phonenumber@0.3.6+8.13.36"}}
{"adv_id": "RUSTSEC-2024-0405", "crate": "rustyscript", "date": "2024-07-18", "url": "https://github.com/rscarson/rustyscript/issues/174", "title": "op_panic in the base runtime can force a panic in the runtime's containing thread", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["panic"], "pre_version": "0.6.0", "post_version": "0.6.1", "stage": "strict_safe", "changed_files": ["src/error.rs", "src/inner_runtime.rs"], "changed_lines": 6, "unsafe_in_changed_files": 0, "changed_functions": ["inner_runtime::eval"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] unions are not supported", "lean_lines": null, "seconds": 125.5, "item_id": "adv-RUSTSEC-2024-0405", "kind": "advisory", "labels": {"buggy": "rustyscript@0.6.0", "reference": "rustyscript@0.6.1"}}
{"adv_id": "RUSTSEC-2024-0437", "crate": "protobuf", "date": "2024-12-12", "url": "https://github.com/stepancheg/rust-protobuf/issues/749", "title": "Crash due to uncontrolled recursion in protobuf crate", "categories": ["denial-of-service"], "affected_functions": ["protobuf::coded_input_stream::CodedInputStream::skip_group"], "bug_class": ["overflow", "panic", "dos_loop_or_recursion", "logic"], "pre_version": "3.7.1", "post_version": "3.7.2", "stage": "diff_safe", "changed_files": ["src/coded_input_stream/mod.rs"], "changed_lines": 73, "unsafe_in_changed_files": 4, "changed_functions": ["coded_input_stream::drop", "coded_input_stream::merge_message", "coded_input_stream::skip_group"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Dynamic trait types are not supported yet", "lean_lines": null, "seconds": 16.6, "item_id": "adv-RUSTSEC-2024-0437", "kind": "advisory", "labels": {"buggy": "protobuf@3.7.1", "reference": "protobuf@3.7.2"}}
{"adv_id": "RUSTSEC-2024-0445", "crate": "cap-primitives", "date": "2024-11-05", "url": "https://github.com/bytecodealliance/cap-std/pull/371", "title": "cap-primitives doesn't fully sandbox all the Windows device filenames", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "3.4.0", "post_version": "3.4.1", "stage": "strict_safe", "changed_files": ["src/windows/fs/open_impl.rs"], "changed_lines": 6, "unsafe_in_changed_files": 0, "changed_functions": ["windows::fs::open_impl::open_impl"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: /work/translate/RUSTSEC-2024-0445/Crate.lean:12958:2: error: `find` is not a field of structure `core.iter.traits.iterator.Iterator`\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2024-0445/Crate.lean:12965:2: error: `rev` is not a field of structure `core.iter.traits.iterator.Iterator`\n", "lean_lines": 13560, "seconds": 48.8, "item_id": "adv-RUSTSEC-2024-0445", "kind": "advisory", "labels": {"buggy": "cap-primitives@3.4.0", "reference": "cap-primitives@3.4.1"}}
{"adv_id": "RUSTSEC-2025-0008", "crate": "openh264-sys2", "date": "2025-02-24", "url": null, "title": "Openh264 Decoding Functions Heap Overflow Vulnerability", "categories": ["memory-corruption"], "affected_functions": [], "bug_class": ["overflow", "logic"], "pre_version": "0.7.1", "post_version": "0.8.0", "stage": "diff_safe", "changed_files": ["src/generated/types.rs"], "changed_lines": 18, "unsafe_in_changed_files": 74, "changed_functions": ["generated::types::default"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 154.0, "item_id": "adv-RUSTSEC-2025-0008", "kind": "advisory", "labels": {"buggy": "openh264-sys2@0.7.1", "reference": "openh264-sys2@0.8.0"}}
{"adv_id": "RUSTSEC-2025-0009", "crate": "ring", "date": "2025-03-06", "url": "https://github.com/briansmith/ring/blob/main/RELEASES.md#version-01712-2025-03-05", "title": "Some AES functions may panic when overflow checking is enabled.", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["overflow", "panic"], "pre_version": "0.17.11", "post_version": "0.17.12", "stage": "strict_safe", "changed_files": ["src/aead/aes.rs"], "changed_lines": 2, "unsafe_in_changed_files": 0, "changed_functions": ["aead::aes::increment_by_less_safe"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 52.5, "item_id": "adv-RUSTSEC-2025-0009", "kind": "advisory", "labels": {"buggy": "ring@0.17.11", "reference": "ring@0.17.12"}}
{"adv_id": "RUSTSEC-2025-0062", "crate": "toodee", "date": "2025-05-22", "url": "https://github.com/antonmarsden/toodee/issues/26", "title": "Heap Buffer Overflow in the DrainCol Destructor", "categories": ["memory-corruption", "memory-exposure"], "affected_functions": ["toodee::DrainCol::drop"], "bug_class": ["overflow"], "pre_version": "0.5.0", "post_version": "0.6.0", "stage": "diff_safe", "changed_files": ["src/tests.rs", "src/toodee.rs"], "changed_lines": 10, "unsafe_in_changed_files": 54, "changed_functions": ["toodee::drop", "toodee::from_box"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 74, "seconds": 22.1, "item_id": "adv-RUSTSEC-2025-0062", "kind": "advisory", "labels": {"buggy": "toodee@0.5.0", "reference": "toodee@0.6.0"}}
{"adv_id": "RUSTSEC-2025-0065", "crate": "matrix-sdk-base", "date": "2025-09-11", "url": "https://github.com/matrix-org/matrix-rust-sdk/pull/5635", "title": "matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method", "categories": [], "affected_functions": ["matrix_sdk_base::RoomMember::normalized_power_level"], "bug_class": ["panic"], "pre_version": "0.14.0", "post_version": "0.14.1", "stage": "strict_safe", "changed_files": ["src/room/members.rs"], "changed_lines": 79, "unsafe_in_changed_files": 0, "changed_functions": ["room::members::as_vec", "room::members::normalized_power_level"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Assertion failed: new value doesn't have the same type as its destination", "lean_lines": null, "seconds": 73.7, "item_id": "adv-RUSTSEC-2025-0065", "kind": "advisory", "labels": {"buggy": "matrix-sdk-base@0.14.0", "reference": "matrix-sdk-base@0.14.1"}}
{"adv_id": "RUSTSEC-2025-0071", "crate": "ammonia", "date": "2025-09-21", "url": null, "title": "Incorrect handling of embedded SVG and MathML leads to mutation XSS after removal", "categories": ["format-injection"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "3.3.0", "post_version": "3.3.1", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 54, "unsafe_in_changed_files": 0, "changed_functions": ["check_expected_namespace", "clean_dom", "is_url_attr"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error[E0422]: cannot find struct, variant or union type `LineColumn` in crate `proc_macro`", "lean_lines": null, "seconds": 3.6, "item_id": "adv-RUSTSEC-2025-0071", "kind": "advisory", "labels": {"buggy": "ammonia@3.3.0", "reference": "ammonia@3.3.1"}}
{"adv_id": "RUSTSEC-2025-0073", "crate": "alloy-dyn-abi", "date": "2025-10-15", "url": "https://github.com/alloy-rs/core/commit/7823e9af8c20e9fcfb5360f5eafd891c457ebccf", "title": "DoS vulnerability on `alloy_dyn_abi::TypedData` hashing", "categories": ["denial-of-service"], "affected_functions": ["alloy_dyn_abi::eip712::Resolver::encode_type"], "bug_class": ["panic"], "pre_version": "0.8.25", "post_version": "0.8.26", "stage": "diff_safe", "changed_files": ["src/arbitrary.rs", "src/eip712/parser.rs", "src/eip712/resolver.rs", "src/eip712/typed_data.rs"], "changed_lines": 87, "unsafe_in_changed_files": 2, "changed_functions": ["arbitrary::new", "eip712::parser::parse", "eip712::resolver::encode_type"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 153.7, "item_id": "adv-RUSTSEC-2025-0073", "kind": "advisory", "labels": {"buggy": "alloy-dyn-abi@0.8.25", "reference": "alloy-dyn-abi@0.8.26"}}
{"adv_id": "RUSTSEC-2026-0007", "crate": "bytes", "date": "2026-02-03", "url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f", "title": "Integer overflow in `BytesMut::reserve`", "categories": ["memory-corruption"], "affected_functions": [], "bug_class": ["overflow", "panic", "logic"], "pre_version": "1.11.0", "post_version": "1.11.1", "stage": "diff_safe", "changed_files": ["src/bytes_mut.rs"], "changed_lines": 20, "unsafe_in_changed_files": 100, "changed_functions": ["bytes_mut::reserve_inner"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Aeneas does not yet support dereferencing raw pointers.", "lean_lines": null, "seconds": 2.9, "item_id": "adv-RUSTSEC-2026-0007", "kind": "advisory", "labels": {"buggy": "bytes@1.11.0", "reference": "bytes@1.11.1"}}
{"adv_id": "RUSTSEC-2026-0023", "crate": "libcrux-ecdh", "date": "2026-01-26", "url": "https://github.com/cryspen/libcrux/pull/1301", "title": "X25519 secret validation did not check buffer length or clamping", "categories": [], "affected_functions": ["libcrux_ecdh::validate_scalar"], "bug_class": ["dos_loop_or_recursion", "logic"], "pre_version": "0.0.5", "post_version": "0.0.6", "stage": "strict_safe", "changed_files": ["src/ecdh.rs"], "changed_lines": 7, "unsafe_in_changed_files": 0, "changed_functions": ["ecdh::validate_scalar"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: STSEC-2026-0023/Crate.lean:2793:4: error: `libcrux_ecdh.hacl.Error.Insts.CoreConvertFromError.from` has already been declared\n/apps/development/rlhf/bugfind_data/work/translate/RUSTSEC-2026-0023/Crate.lean:2800:4: error: `libcrux_ecdh.hacl.Error.Insts.CoreConvertFromError` has already been declared\n", "lean_lines": 3294, "seconds": 22.7, "item_id": "adv-RUSTSEC-2026-0023", "kind": "advisory", "labels": {"buggy": "libcrux-ecdh@0.0.5", "reference": "libcrux-ecdh@0.0.6"}}
{"adv_id": "RUSTSEC-2026-0026", "crate": "libcrux-ed25519", "date": "2026-02-05", "url": "https://github.com/cryspen/libcrux/pull/1320", "title": "Unnecessary clamping of seed reduces seed entropy to 251 bits", "categories": [], "affected_functions": ["libcrux_ed25519::generate_key_pair"], "bug_class": ["other"], "pre_version": "0.0.5", "post_version": "0.0.6", "stage": "strict_safe", "changed_files": ["src/impl_hacl.rs"], "changed_lines": 5, "unsafe_in_changed_files": 0, "changed_functions": ["impl_hacl::generate_key_pair"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas/lean timeout", "lean_lines": 23, "seconds": 343.8, "item_id": "adv-RUSTSEC-2026-0026", "kind": "advisory", "labels": {"buggy": "libcrux-ed25519@0.0.5", "reference": "libcrux-ed25519@0.0.6"}}
{"adv_id": "RUSTSEC-2026-0035", "crate": "pingora-cache", "date": "2026-03-04", "url": "https://blog.cloudflare.com/pingora-oss-smuggling-vulnerabilities/", "title": "Cache poisoning via insecure-by-default cache key", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.7.0", "post_version": "0.8.0", "stage": "strict_safe", "changed_files": ["src/key.rs"], "changed_lines": 14, "unsafe_in_changed_files": 0, "changed_functions": ["key::default", "key::primary_hasher"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unexpected error", "lean_lines": null, "seconds": 106.4, "item_id": "adv-RUSTSEC-2026-0035", "kind": "advisory", "labels": {"buggy": "pingora-cache@0.7.0", "reference": "pingora-cache@0.8.0"}}
{"adv_id": "RUSTSEC-2026-0049", "crate": "rustls-webpki", "date": "2026-03-20", "url": null, "title": "CRLs not considered authoritative by Distribution Point due to faulty matching logic", "categories": ["privilege-escalation"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.103.9", "post_version": "0.103.10", "stage": "strict_safe", "changed_files": ["src/alg_tests.rs", "src/cert.rs", "src/crl/types.rs", "src/der.rs", "src/end_entity.rs", "src/verify_cert.rs"], "changed_lines": 94, "unsafe_in_changed_files": 0, "changed_functions": ["crl::types::authoritative_for", "crl::types::uri_name_in_common", "verify_cert::next"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Early returns inside of loops are not supported yet", "lean_lines": null, "seconds": 7.8, "item_id": "adv-RUSTSEC-2026-0049", "kind": "advisory", "labels": {"buggy": "rustls-webpki@0.103.9", "reference": "rustls-webpki@0.103.10"}}
{"adv_id": "RUSTSEC-2026-0075", "crate": "libcrux-ed25519", "date": "2026-03-04", "url": "https://github.com/cryspen/libcrux/pull/1349", "title": "All-Zero Key Generation on Catastrophic RNG Failure", "categories": [], "affected_functions": ["libcrux_ed25519::generate_key_pair"], "bug_class": ["other"], "pre_version": "0.0.6", "post_version": "0.0.7", "stage": "strict_safe", "changed_files": ["src/impl_hacl.rs"], "changed_lines": 6, "unsafe_in_changed_files": 0, "changed_functions": ["impl_hacl::generate_key_pair"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas/lean timeout", "lean_lines": 23, "seconds": 344.3, "item_id": "adv-RUSTSEC-2026-0075", "kind": "advisory", "labels": {"buggy": "libcrux-ed25519@0.0.6", "reference": "libcrux-ed25519@0.0.7"}}
{"adv_id": "RUSTSEC-2026-0076", "crate": "libcrux-ml-dsa", "date": "2026-03-04", "url": "https://github.com/cryspen/libcrux/pull/1348", "title": "Panic in Signature Hint Decoding During Verification", "categories": [], "affected_functions": ["libcrux_ml_dsa::ml_dsa_44::verify", "libcrux_ml_dsa::ml_dsa_65::verify", "libcrux_ml_dsa::ml_dsa_87::verify"], "bug_class": ["panic", "logic"], "pre_version": "0.0.7", "post_version": "0.0.8", "stage": "strict_safe", "changed_files": ["src/encoding/signature.rs", "src/ml_dsa_generic.rs"], "changed_lines": 7, "unsafe_in_changed_files": 0, "changed_functions": ["encoding::signature::deserialize", "ml_dsa_generic::verify_internal"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unreachable", "lean_lines": null, "seconds": 18.8, "item_id": "adv-RUSTSEC-2026-0076", "kind": "advisory", "labels": {"buggy": "libcrux-ml-dsa@0.0.7", "reference": "libcrux-ml-dsa@0.0.8"}}
{"adv_id": "RUSTSEC-2026-0086", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/pull/13009", "title": "Host data leakage with 64-bit tables and Winch", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "36.0.6", "post_version": "36.0.7", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs", "src/runtime/vm/cow.rs"], "changed_lines": 4, "unsafe_in_changed_files": 100, "changed_functions": ["runtime::component::values::push_flags", "runtime::vm::cow::instantiate"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: f/bugfind_data/work/translate/RUSTSEC-2026-0086/Crate.lean:1664:4: error(lean.synthInstanceFailed): failed to synthesize instance of type class\n  Decidable (base = right_val)\n\nHint: Type class instance resolution failures can be inspected with the `set_option trace.Meta.synthInstance true` command.\n", "lean_lines": 3561, "seconds": 139.2, "item_id": "adv-RUSTSEC-2026-0086", "kind": "advisory", "labels": {"buggy": "wasmtime@36.0.6", "reference": "wasmtime@36.0.7"}}
{"adv_id": "RUSTSEC-2026-0090", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/issues/12069", "title": "Use-after-free bug after cloning `wasmtime::Linker`", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "43.0.0", "post_version": "43.0.1", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs", "src/runtime/vm/cow.rs"], "changed_lines": 4, "unsafe_in_changed_files": 88, "changed_functions": ["runtime::component::values::push_flags", "runtime::vm::cow::instantiate"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Dynamic trait types are not supported yet", "lean_lines": null, "seconds": 127.3, "item_id": "adv-RUSTSEC-2026-0090", "kind": "advisory", "labels": {"buggy": "wasmtime@43.0.0", "reference": "wasmtime@43.0.1"}}
{"adv_id": "RUSTSEC-2026-0091", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/pull/13026", "title": "Out-of-bounds write or crash when transcoding component model strings", "categories": [], "affected_functions": [], "bug_class": ["panic"], "pre_version": "24.0.6", "post_version": "24.0.7", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs"], "changed_lines": 2, "unsafe_in_changed_files": 2, "changed_functions": ["runtime::component::values::push_flags"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: implicit autoref creates a reference to the dereference of a raw pointer", "lean_lines": null, "seconds": 86.2, "item_id": "adv-RUSTSEC-2026-0091", "kind": "advisory", "labels": {"buggy": "wasmtime@24.0.6", "reference": "wasmtime@24.0.7"}}
{"adv_id": "RUSTSEC-2026-0093", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/pull/13016", "title": "Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "24.0.6", "post_version": "24.0.7", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs"], "changed_lines": 2, "unsafe_in_changed_files": 2, "changed_functions": ["runtime::component::values::push_flags"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon: error: implicit autoref creates a reference to the dereference of a raw pointer", "lean_lines": null, "seconds": 84.6, "item_id": "adv-RUSTSEC-2026-0093", "kind": "advisory", "labels": {"buggy": "wasmtime@24.0.6", "reference": "wasmtime@24.0.7"}}
{"adv_id": "RUSTSEC-2026-0094", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/pull/13014", "title": "Improperly masked return value from `table.grow` with Winch compiler backend", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "36.0.6", "post_version": "36.0.7", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs", "src/runtime/vm/cow.rs"], "changed_lines": 4, "unsafe_in_changed_files": 100, "changed_functions": ["runtime::component::values::push_flags", "runtime::vm::cow::instantiate"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: f/bugfind_data/work/translate/RUSTSEC-2026-0094/Crate.lean:1664:4: error(lean.synthInstanceFailed): failed to synthesize instance of type class\n  Decidable (base = right_val)\n\nHint: Type class instance resolution failures can be inspected with the `set_option trace.Meta.synthInstance true` command.\n", "lean_lines": 3561, "seconds": 135.5, "item_id": "adv-RUSTSEC-2026-0094", "kind": "advisory", "labels": {"buggy": "wasmtime@36.0.6", "reference": "wasmtime@36.0.7"}}
{"adv_id": "RUSTSEC-2026-0095", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/pull/13014", "title": "Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "36.0.6", "post_version": "36.0.7", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs", "src/runtime/vm/cow.rs"], "changed_lines": 4, "unsafe_in_changed_files": 100, "changed_functions": ["runtime::component::values::push_flags", "runtime::vm::cow::instantiate"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: f/bugfind_data/work/translate/RUSTSEC-2026-0095/Crate.lean:1664:4: error(lean.synthInstanceFailed): failed to synthesize instance of type class\n  Decidable (base = right_val)\n\nHint: Type class instance resolution failures can be inspected with the `set_option trace.Meta.synthInstance true` command.\n", "lean_lines": 3561, "seconds": 136.4, "item_id": "adv-RUSTSEC-2026-0095", "kind": "advisory", "labels": {"buggy": "wasmtime@36.0.6", "reference": "wasmtime@36.0.7"}}
{"adv_id": "RUSTSEC-2026-0096", "crate": "wasmtime", "date": "2026-04-09", "url": "https://github.com/bytecodealliance/wasmtime/pull/13013", "title": "Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "36.0.6", "post_version": "36.0.7", "stage": "diff_safe", "changed_files": ["src/runtime/component/values.rs", "src/runtime/vm/cow.rs"], "changed_lines": 4, "unsafe_in_changed_files": 100, "changed_functions": ["runtime::component::values::push_flags", "runtime::vm::cow::instantiate"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": false, "translated": false, "error": "lean: f/bugfind_data/work/translate/RUSTSEC-2026-0096/Crate.lean:1664:4: error(lean.synthInstanceFailed): failed to synthesize instance of type class\n  Decidable (base = right_val)\n\nHint: Type class instance resolution failures can be inspected with the `set_option trace.Meta.synthInstance true` command.\n", "lean_lines": 3561, "seconds": 142.7, "item_id": "adv-RUSTSEC-2026-0096", "kind": "advisory", "labels": {"buggy": "wasmtime@36.0.6", "reference": "wasmtime@36.0.7"}}
{"adv_id": "RUSTSEC-2026-0114", "crate": "wasmtime", "date": "2026-04-30", "url": "https://github.com/bytecodealliance/wasmtime/pull/13245", "title": "Panic when allocating a table exceeding the size of the host's address space", "categories": [], "affected_functions": [], "bug_class": ["panic"], "pre_version": "36.0.7", "post_version": "36.0.8", "stage": "diff_safe", "changed_files": ["src/runtime/vm/table.rs"], "changed_lines": 14, "unsafe_in_changed_files": 54, "changed_functions": ["runtime::vm::table::alloc_dynamic_table_elements", "runtime::vm::table::default", "runtime::vm::table::grow"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Early returns inside of loops are not supported yet", "lean_lines": null, "seconds": 161.6, "item_id": "adv-RUSTSEC-2026-0114", "kind": "advisory", "labels": {"buggy": "wasmtime@36.0.7", "reference": "wasmtime@36.0.8"}}
{"adv_id": "RUSTSEC-2026-0124", "crate": "libcrux-chacha20poly1305", "date": "2026-03-29", "url": "https://github.com/cryspen/libcrux/pull/1386", "title": "Potential Panic on Overlong Ciphertext Buffer", "categories": [], "affected_functions": ["libcrux_chacha20poly1305::encrypt", "libcrux_chacha20poly1305::xchacha20_poly1305::encrypt"], "bug_class": ["panic"], "pre_version": "0.0.7", "post_version": "0.0.8", "stage": "strict_safe", "changed_files": ["src/impl_hacl.rs"], "changed_lines": 5, "unsafe_in_changed_files": 0, "changed_functions": ["impl_hacl::encrypt"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": true, "translated": true, "error": null, "lean_lines": 2737, "seconds": 88.7, "item_id": "adv-RUSTSEC-2026-0124", "kind": "advisory", "labels": {"buggy": "libcrux-chacha20poly1305@0.0.7", "reference": "libcrux-chacha20poly1305@0.0.8"}}
{"adv_id": "RUSTSEC-2026-0140", "crate": "dynoxide-rs", "date": "2026-05-12", "url": "https://github.com/nubo-db/dynoxide/commit/10292083fd16fe7116e9089ffa189f4f4f071e0f", "title": "DNS rebinding and cross-origin CSRF in dynoxide's MCP HTTP transport", "categories": [], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.9.12", "post_version": "0.9.13", "stage": "diff_safe", "changed_files": ["src/mcp/mod.rs", "src/mcp/server.rs"], "changed_lines": 18, "unsafe_in_changed_files": 2, "changed_functions": ["mcp::serve_http_with_shutdown", "mcp::server::default", "mcp::server::with_config"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon timeout", "lean_lines": null, "seconds": 300.4, "item_id": "adv-RUSTSEC-2026-0140", "kind": "advisory", "labels": {"buggy": "dynoxide-rs@0.9.12", "reference": "dynoxide-rs@0.9.13"}}
{"adv_id": "RUSTSEC-2026-0145", "crate": "astral-tokio-tar", "date": "2026-05-18", "url": "https://github.com/astral-sh/tokio-tar/pull/82", "title": "PAX Header Desynchronization in astral-tokio-tar", "categories": ["file-disclosure"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.6.1", "post_version": "0.6.2", "stage": "strict_safe", "changed_files": ["src/archive.rs"], "changed_lines": 14, "unsafe_in_changed_files": 0, "changed_functions": ["archive::poll_next_raw"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Returns inside of nested loops are not supported yet", "lean_lines": null, "seconds": 14.8, "item_id": "adv-RUSTSEC-2026-0145", "kind": "advisory", "labels": {"buggy": "astral-tokio-tar@0.6.1", "reference": "astral-tokio-tar@0.6.2"}}
{"adv_id": "RUSTSEC-2026-0149", "crate": "wasmtime-wasi", "date": "2026-05-21", "url": "https://github.com/bytecodealliance/wasmtime/pull/13429", "title": "WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "24.0.8", "post_version": "24.0.9", "stage": "strict_safe", "changed_files": ["src/host/filesystem.rs"], "changed_lines": 1, "unsafe_in_changed_files": 0, "changed_functions": ["host::filesystem::open_at"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas/lean timeout", "lean_lines": 23, "seconds": 366.3, "item_id": "adv-RUSTSEC-2026-0149", "kind": "advisory", "labels": {"buggy": "wasmtime-wasi@24.0.8", "reference": "wasmtime-wasi@24.0.9"}}
{"adv_id": "RUSTSEC-2026-0152", "crate": "oneringbuf", "date": "2026-05-27", "url": "https://github.com/skilvingr/rust-oneringbuf/commit/643a24b30914068416dff9021a069c12c865a316", "title": "Use-after-free", "categories": ["memory-corruption"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.7.1", "post_version": "0.8.0", "stage": "diff_safe", "changed_files": ["src/ring_buffer/impls.rs", "src/ring_buffer/wrappers/refs/droppable.rs", "src/ring_buffer/wrappers/refs/mod.rs", "src/ring_buffer/wrappers/refs/non_droppable.rs"], "changed_lines": 24, "unsafe_in_changed_files": 10, "changed_functions": ["ring_buffer::impls::into_ref", "ring_buffer::impls::split_mut", "ring_buffer::wrappers::refs::into_ref"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 38, "seconds": 15.5, "item_id": "adv-RUSTSEC-2026-0152", "kind": "advisory", "labels": {"buggy": "oneringbuf@0.7.1", "reference": "oneringbuf@0.8.0"}}
{"adv_id": "RUSTSEC-2026-0158", "crate": "matrix-sdk-ui", "date": "2026-06-03", "url": "https://github.com/matrix-org/matrix-rust-sdk/pull/6454", "title": "Incomplete message edit validation in matrix-sdk-ui", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.16.0", "post_version": "0.16.1", "stage": "strict_safe", "changed_files": ["src/timeline/controller/aggregations.rs"], "changed_lines": 69, "unsafe_in_changed_files": 0, "changed_functions": ["timeline::controller::aggregations::edit_item", "timeline::controller::aggregations::resolve_edits"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Detected groups of mixed mutually recursive definitions (such as a type mutually recursive with a function, or a function mutually recursive with a trait implementation):", "lean_lines": null, "seconds": 176.0, "item_id": "adv-RUSTSEC-2026-0158", "kind": "advisory", "labels": {"buggy": "matrix-sdk-ui@0.16.0", "reference": "matrix-sdk-ui@0.16.1"}}
{"adv_id": "RUSTSEC-2026-0179", "crate": "postgres-protocol", "date": "2026-06-12", "url": "https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0", "title": "Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service", "categories": ["denial-of-service"], "affected_functions": ["postgres_protocol::authentication::sasl::ScramSha256::update"], "bug_class": ["dos_loop_or_recursion"], "pre_version": "0.6.11", "post_version": "0.6.12", "stage": "strict_safe", "changed_files": ["src/authentication/sasl.rs", "src/types/mod.rs", "src/types/test.rs"], "changed_lines": 75, "unsafe_in_changed_files": 0, "changed_functions": ["authentication::sasl::update", "authentication::sasl::value"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon timeout", "lean_lines": null, "seconds": 300.1, "item_id": "adv-RUSTSEC-2026-0179", "kind": "advisory", "labels": {"buggy": "postgres-protocol@0.6.11", "reference": "postgres-protocol@0.6.12"}}
{"adv_id": "RUSTSEC-2026-0180", "crate": "postgres-protocol", "date": "2026-06-12", "url": "https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d", "title": "Panic decoding a malformed `hstore` value allows denial of service", "categories": ["denial-of-service"], "affected_functions": ["postgres_protocol::types::hstore_from_sql"], "bug_class": ["panic", "logic"], "pre_version": "0.6.11", "post_version": "0.6.12", "stage": "strict_safe", "changed_files": ["src/authentication/sasl.rs", "src/types/mod.rs", "src/types/test.rs"], "changed_lines": 75, "unsafe_in_changed_files": 0, "changed_functions": ["authentication::sasl::update", "authentication::sasl::value"], "charon_ok": false, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "charon timeout", "lean_lines": null, "seconds": 300.1, "item_id": "adv-RUSTSEC-2026-0180", "kind": "advisory", "labels": {"buggy": "postgres-protocol@0.6.11", "reference": "postgres-protocol@0.6.12"}}
{"adv_id": "RUSTSEC-2026-0188", "crate": "wasmtime-wasi", "date": "2026-06-24", "url": "https://github.com/bytecodealliance/wasmtime/pull/13725", "title": "WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination", "categories": [], "affected_functions": [], "bug_class": ["logic"], "pre_version": "24.0.10", "post_version": "24.0.11", "stage": "strict_safe", "changed_files": ["src/host/filesystem.rs"], "changed_lines": 6, "unsafe_in_changed_files": 0, "changed_functions": ["host::filesystem::link_at", "host::filesystem::rename_at"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas/lean timeout", "lean_lines": 23, "seconds": 364.6, "item_id": "adv-RUSTSEC-2026-0188", "kind": "advisory", "labels": {"buggy": "wasmtime-wasi@24.0.10", "reference": "wasmtime-wasi@24.0.11"}}
{"adv_id": "RUSTSEC-2026-0199", "crate": "bcrypt", "date": "2026-06-20", "url": "https://github.com/Keats/rust-bcrypt/pull/103", "title": "Panic in `bcrypt::verify` on non-ASCII hash input", "categories": ["denial-of-service"], "affected_functions": [], "bug_class": ["panic", "logic"], "pre_version": "0.19.1", "post_version": "0.19.2", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 33, "unsafe_in_changed_files": 0, "changed_functions": ["doesnt_verify_different_passwords", "split_hash"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] There should be no bottoms in the value", "lean_lines": null, "seconds": 5.8, "item_id": "adv-RUSTSEC-2026-0199", "kind": "advisory", "labels": {"buggy": "bcrypt@0.19.1", "reference": "bcrypt@0.19.2"}}
{"adv_id": "RUSTSEC-2026-0213", "crate": "ammonia", "date": "2026-07-21", "url": null, "title": "XSS in ammonia via SVG `animate` and `set` animation tags", "categories": ["format-injection"], "affected_functions": [], "bug_class": ["other"], "pre_version": "3.3.2", "post_version": "3.3.3", "stage": "strict_safe", "changed_files": ["src/lib.rs"], "changed_lines": 20, "unsafe_in_changed_files": 0, "changed_functions": ["clean_dom", "is_url_attr"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Dynamic trait types are not supported yet", "lean_lines": null, "seconds": 36.0, "item_id": "adv-RUSTSEC-2026-0213", "kind": "advisory", "labels": {"buggy": "ammonia@3.3.2", "reference": "ammonia@3.3.3"}}
{"adv_id": "RUSTSEC-2026-0217", "crate": "tract-nnef", "date": "2026-06-18", "url": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8", "title": "Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load", "categories": ["memory-exposure", "denial-of-service"], "affected_functions": ["tract_nnef::tensors::read_tensor"], "bug_class": ["overflow", "panic", "logic"], "pre_version": "0.21.15", "post_version": "0.21.16", "stage": "diff_safe", "changed_files": ["src/tensors.rs"], "changed_lines": 19, "unsafe_in_changed_files": 14, "changed_functions": ["tensors::read_block_quant_value", "tensors::read_tensor"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Early returns inside of loops are not supported yet", "lean_lines": null, "seconds": 141.0, "item_id": "adv-RUSTSEC-2026-0217", "kind": "advisory", "labels": {"buggy": "tract-nnef@0.21.15", "reference": "tract-nnef@0.21.16"}}
{"adv_id": "RUSTSEC-2026-0219", "crate": "nostr", "date": "2026-07-26", "url": "https://github.com/nostrdevkit/nostr/commit/b24619346f666d08ef7fefe27f033b8bc871697f", "title": "Remote Denial of Service via malformed NIP-04 IV", "categories": ["denial-of-service"], "affected_functions": ["nostr::nips::nip04::decrypt", "nostr::nips::nip04::decrypt_to_bytes"], "bug_class": ["panic", "logic"], "pre_version": "0.44.5", "post_version": "0.44.6", "stage": "strict_safe", "changed_files": ["src/nips/nip04.rs"], "changed_lines": 33, "unsafe_in_changed_files": 0, "changed_functions": ["nips::nip04::decrypt_to_bytes", "nips::nip04::encrypt_with_rng", "nips::nip04::fmt"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "start function not in generated Lean", "lean_lines": 23, "seconds": 222.1, "item_id": "adv-RUSTSEC-2026-0219", "kind": "advisory", "labels": {"buggy": "nostr@0.44.5", "reference": "nostr@0.44.6"}}
{"adv_id": "RUSTSEC-2026-0274", "crate": "rtrb", "date": "2026-08-04", "url": "https://github.com/mgeier/rtrb/issues/185", "title": "Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics", "categories": ["memory-corruption"], "affected_functions": ["rtrb::chunks::ReadChunk::commit", "rtrb::chunks::ReadChunk::commit_all"], "bug_class": ["panic", "dos_loop_or_recursion"], "pre_version": "0.3.4", "post_version": "0.3.5", "stage": "diff_safe", "changed_files": ["src/chunks.rs"], "changed_lines": 31, "unsafe_in_changed_files": 98, "changed_functions": ["chunks::commit_unchecked"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": true, "translated": true, "error": null, "lean_lines": 299, "seconds": 4.7, "item_id": "adv-RUSTSEC-2026-0274", "kind": "advisory", "labels": {"buggy": "rtrb@0.3.4", "reference": "rtrb@0.3.5"}}
{"adv_id": "RUSTSEC-2026-0278", "crate": "zbus_polkit", "date": "2026-08-31", "url": "https://github.com/z-galaxy/zbus_polkit/pull/101", "title": "`zbus_polkit`: authorization bypass via PID reuse", "categories": ["privilege-escalation"], "affected_functions": ["zbus_polkit::Subject::new_for_owner"], "bug_class": ["logic"], "pre_version": "5.0.0", "post_version": "5.1.0", "stage": "diff_safe", "changed_files": ["src/policykit1.rs"], "changed_lines": 4, "unsafe_in_changed_files": 2, "changed_functions": ["policykit1::new_for_owner", "policykit1::try_from"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Unimplemented", "lean_lines": null, "seconds": 42.0, "item_id": "adv-RUSTSEC-2026-0278", "kind": "advisory", "labels": {"buggy": "zbus_polkit@5.0.0", "reference": "zbus_polkit@5.1.0"}}
{"adv_id": "RUSTSEC-2026-0307", "crate": "uncbv", "date": "2026-09-23", "url": "https://github.com/antoyo/uncbv", "title": "`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)", "categories": ["code-execution"], "affected_functions": [], "bug_class": ["other"], "pre_version": "0.3.0", "post_version": "0.3.1", "stage": "diff_safe", "changed_files": ["src/archive.rs"], "changed_lines": 17, "unsafe_in_changed_files": 4, "changed_functions": ["archive::extract", "archive::init_output"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Breaks to outer loops are not supported yet", "lean_lines": null, "seconds": 19.4, "item_id": "adv-RUSTSEC-2026-0307", "kind": "advisory", "labels": {"buggy": "uncbv@0.3.0", "reference": "uncbv@0.3.1"}}
{"adv_id": "RUSTSEC-2026-0312", "crate": "x509-validator", "date": "2026-09-24", "url": "https://github.com/namecare/x509-validator/commit/da661f8ecee820e05d089a76ecb654ff52a2c987", "title": "Excluded iPAddress name constraints with an all-zero mask are not applied", "categories": ["crypto-failure"], "affected_functions": [], "bug_class": ["logic"], "pre_version": "0.3.0", "post_version": "0.3.1", "stage": "strict_safe", "changed_files": ["src/rfc5280/ip_constraints.rs"], "changed_lines": 34, "unsafe_in_changed_files": 0, "changed_functions": ["rfc5280::ip_constraints::is_valid_cidr_mask"], "charon_ok": true, "aeneas_ok": true, "fn_present": true, "lean_ok": true, "translated": true, "error": null, "lean_lines": 221, "seconds": 19.4, "item_id": "adv-RUSTSEC-2026-0312", "kind": "advisory", "labels": {"buggy": "x509-validator@0.3.0", "reference": "x509-validator@0.3.1"}}
{"adv_id": "RUSTSEC-2026-0313", "crate": "wasmtime-wasi-http", "date": "2026-09-24", "url": "https://github.com/bytecodealliance/wasmtime/pull/14408", "title": "Outgoing HTTP body write allows guest-driven host memory exhaustion", "categories": [], "affected_functions": [], "bug_class": ["dos_loop_or_recursion"], "pre_version": "36.0.15", "post_version": "36.0.16", "stage": "strict_safe", "changed_files": ["src/body.rs"], "changed_lines": 3, "unsafe_in_changed_files": 0, "changed_functions": ["body::write"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas/lean timeout", "lean_lines": 23, "seconds": 388.0, "item_id": "adv-RUSTSEC-2026-0313", "kind": "advisory", "labels": {"buggy": "wasmtime-wasi-http@36.0.15", "reference": "wasmtime-wasi-http@36.0.16"}}
{"adv_id": "RUSTSEC-2026-0314", "crate": "wasmtime-wasi", "date": "2026-09-24", "url": "https://github.com/bytecodealliance/wasmtime/pull/14403", "title": "Guest can panic host through filesystem datetime overflow", "categories": [], "affected_functions": [], "bug_class": ["overflow", "panic"], "pre_version": "36.0.15", "post_version": "36.0.16", "stage": "diff_safe", "changed_files": ["src/p2/host/filesystem.rs"], "changed_lines": 10, "unsafe_in_changed_files": 2, "changed_functions": ["p2::host::filesystem::systemtime_from"], "charon_ok": true, "aeneas_ok": false, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas: [Error] Assertion failed: new value doesn't have the same type as its destination", "lean_lines": null, "seconds": 83.5, "item_id": "adv-RUSTSEC-2026-0314", "kind": "advisory", "labels": {"buggy": "wasmtime-wasi@36.0.15", "reference": "wasmtime-wasi@36.0.16"}}
{"adv_id": "RUSTSEC-2026-0320", "crate": "wasmtime-wasi-http", "date": "2026-10-02", "url": "https://github.com/bytecodealliance/wasmtime/pull/14483", "title": "Wasmtime wasi:http implementation panics with a zero timeout supplied", "categories": [], "affected_functions": [], "bug_class": ["panic"], "pre_version": "48.0.3", "post_version": "48.0.4", "stage": "strict_safe", "changed_files": ["src/default_send_request.rs"], "changed_lines": 7, "unsafe_in_changed_files": 0, "changed_functions": ["default_send_request::size_hint"], "charon_ok": true, "aeneas_ok": true, "fn_present": false, "lean_ok": false, "translated": false, "error": "aeneas/lean timeout", "lean_lines": 23, "seconds": 392.5, "item_id": "adv-RUSTSEC-2026-0320", "kind": "advisory", "labels": {"buggy": "wasmtime-wasi-http@48.0.3", "reference": "wasmtime-wasi-http@48.0.4"}}