Repository navigation
security: 19 CVE advisories in Cargo.lock (bridge triage, Track E) #13
Description
panic-attack estate sweep — Track E bridge triage
panic-attack bridge triage (RustSec advisory DB, with reachability analysis) found 19 CVE/advisory findings in this repo's Cargo.lock (out of 489 total dependencies; 19 vulnerable).
Severity: medium: 19
Reachability: phantom: 19
Classification: informational: 19
Each finding includes a recommended action (often Remove unused dependency for phantom-imported crates). Reachability phantom = declared in Cargo.toml but never imported in any .rs file — removing the dep eliminates the CVE entirely with no behavioural change.
Estate tracker: hyperpolymath/panic-attack#32.
Findings
full advisory list
RUSTSEC-2021-0139 ansi_term@0.12.1 medium reach=phantom class=informational fix=
RUSTSEC-2025-0141 bincode@1.3.3 medium reach=phantom class=informational fix=
RUSTSEC-2024-0384 instant@0.1.13 medium reach=phantom class=informational fix=
GHSA-8c75-8mhr-p7r9 openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-ghm9-cr32-g9qj openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-hppc-g8h3-xhp3 openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-phqj-4mhp-q6mq openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-pqf5-4pqq-29f5 openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-xmgf-hq76-4vx2 openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-xp3w-r5p5-63rr openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-xv59-967r-8726 openssl@0.10.77 medium reach=phantom class=informational fix=
GHSA-6xvm-j4wr-6v98 quinn-proto@0.11.9 medium reach=phantom class=informational fix=
RUSTSEC-2026-0037 quinn-proto@0.11.9 medium reach=phantom class=informational fix=
GHSA-cq8v-f236-94qc rand@0.8.5 medium reach=phantom class=informational fix=
RUSTSEC-2026-0097 rand@0.8.5 medium reach=phantom class=informational fix=
RUSTSEC-2025-0134 rustls-pemfile@2.2.0 medium reach=phantom class=informational fix=
GHSA-82j2-j2ch-gfr8 rustls-webpki@0.103.12 medium reach=phantom class=informational fix=
RUSTSEC-2026-0104 rustls-webpki@0.103.12 medium reach=phantom class=informational fix=
RUSTSEC-2024-0320 yaml-rust@0.4.5 medium reach=phantom class=informational fix=
🤖 Discovered during the panic-attack estate sweep (2026-05-26) — Track E (bridge triage). See hyperpolymath/panic-attack#32 for campaign tracker.
Activity
hyperpolymath commentedon May 27, 2026
Triage (2026-05-27) — Cohort E-2 reassignment
This repo was initially grouped into Cohort E-2 (Dioxus/GTK transitive), but inspection of
Cargo.tomlconfirms it does NOT pull Dioxus or the GTK family. The GUI crate isgossamer-rs(path dep, not a Dioxus desktop wrapper). This repo has been misclassified into E-2 and should be reassigned.Actual parent deps (from workspace
Cargo.toml):reqwest = "0.12"(withrustls-tls) → pullsrustls/rustls-webpki/rustls-pemfile/quinn-proto/randvosk = "0.3"(speech recognition FFI) → pullsopenssl@0.10.77familyarangors = "0.6"(ArangoDB client) → pullsopenssl+ transitive utilitiesnickel-lang-core = "0.10"→ pullsansi_term@0.12.1,instant@0.1.13,yaml-rust@0.4.5comrak/tesseract-rs→ assorted transitives (bincode)Informational (reach=phantom, declared-but-unused via parent):
ansi_term@0.12.1(parent: nickel-lang-core)bincode@1.3.3(parent: transitive utility)instant@0.1.13(parent: nickel-lang-core)openssl@0.10.77(parent: vosk/arangors)openssl@0.10.77openssl@0.10.77openssl@0.10.77openssl@0.10.77openssl@0.10.77openssl@0.10.77openssl@0.10.77quinn-proto@0.11.9(parent: reqwest/http3)quinn-proto@0.11.9rand@0.8.5(parent: rustls/transitive)rand@0.8.5rustls-pemfile@2.2.0(parent: reqwest→rustls)rustls-webpki@0.103.12(parent: reqwest→rustls)rustls-webpki@0.103.12yaml-rust@0.4.5(parent: nickel-lang-core)Reachable (requires upstream fix):
None at present. All 19 are reach=phantom per the bridge.
Closure path:
This issue should be reassigned out of E-2 (no Dioxus/GTK) and remain OPEN until either:
reqwest,vosk,arangors,nickel-lang-core) ship releases that bump their TLS / yaml / instant transitives;vosk/arangorsfor non-openssl alternatives, ORpanic-attack's patch-bridge classifies the phantom set as Informational and we close as accepted-risk (the Cohort E-2 panic-attack tracking issue patch-bridge: classify Dioxus/GTK transitive advisories as Informational (Cohort E-2) panic-attack#75 lists this repo as misclassified and asks for a separate cohort).19 informational, 0 reachable.
hyperpolymath commentedon Jun 16, 2026
The rustls-webpki advisory from this list (GHSA-82j2-j2ch-gfr8 / RUSTSEC-2026-0104, CVSS 7.5 HIGH — DoS via panic on malformed CRL BIT STRING) is fixed in PR #22 (bump to 0.103.13).
hyperpolymath commentedon Jun 17, 2026
Lockfile-only fixes for the live Dependabot advisories in PR #23.
Applied: openssl 0.10.77 -> 0.10.80 (+ openssl-sys 0.9.113 -> 0.9.117); rand 0.8.5 -> 0.8.6.
Deferred / skipped (need separate reviewed work): quinn-proto -> 0.11.14 could NOT be done lockfile-only. The 0.11.14 bump pulls getrandom 0.3.4, which requires wasm-bindgen 0.2.100, but topiary-tree-sitter-facade (via nickel-lang-core) pins wasm-bindgen =0.2.91. Resolving this needs a non-lockfile-only change (Cargo.toml / parent crate bump), so it is out of scope for this lockfile-only pass.
NOT closing -- will close once the PR merges and a re-audit is clean.
hyperpolymath commentedon Jun 17, 2026
Resolved multiple CVEs (quinn, webpki) by updating nickel-lang-core to v0.18 and forcing bulk dependency updates. Verified with cargo audit.