From a memory-safety audit of nobilis on 2 October 2026: its own code has two unsafe blocks (both sound libc calls in main.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in Cargo.lock, and each one traced to whether it is actually compiled in.
Both are compiled in and both are fixed upstream within the version ranges nobilis already allows - cargo update is the fix.
rustls 0.23.43 - RUSTSEC-2026-0285, TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries. Fixed in 0.23.45. rustls carries every TLS connection the daemon makes: IRC, Discord, Matrix, Kick, the forum, and Tor's own (via arti). Checked: cargo update -p [email protected] --precise 0.23.45 resolves.
h2 0.4.15 - RUSTSEC-2026-0258, unbounded empty DATA frames: a server can hold the client in a loop of empty frames. Fixed in 0.4.16; 0.4.19 is current and resolves. Reached through reqwest's HTTP/2.
Afterwards, re-run the advisory check so the next one is caught by a machine rather than an audit - see the hardening issue.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two `unsafe` blocks (both sound libc calls in `main.rs`), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in `Cargo.lock`, and each one traced to whether it is actually compiled in.
Both are compiled in and both are fixed upstream within the version ranges nobilis already allows - `cargo update` is the fix.
- **rustls 0.23.43** - RUSTSEC-2026-0285, *TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries*. Fixed in 0.23.45. rustls carries every TLS connection the daemon makes: IRC, Discord, Matrix, Kick, the forum, and Tor's own (via arti). Checked: `cargo update -p [email protected] --precise 0.23.45` resolves.
- **h2 0.4.15** - RUSTSEC-2026-0258, *unbounded empty DATA frames*: a server can hold the client in a loop of empty frames. Fixed in 0.4.16; 0.4.19 is current and resolves. Reached through reqwest's HTTP/2.
Afterwards, re-run the advisory check so the next one is caught by a machine rather than an audit - see the hardening issue.
Salastil
added this to the v1.0 milestone 2026-10-02 19:03:38 -04:00
Salastil
added the bugCVE labels 2026-10-02 19:03:38 -04:00
Finished. rustls is now 0.23.45 (rustls-webpki 0.103.15) and h2 is 0.4.19. Only the lockfile changed: both were already within the allowed version ranges.
An OSV check of the whole lockfile no longer finds RUSTSEC-2026-0285 or RUSTSEC-2026-0258, and finds nothing new. The tests pass, clippy passes with -D warnings, a real TLS handshake over Tor to an onion service succeeds, and the Windows cross-build builds.
Running the advisory check automatically, so the next one is caught without an audit, is #256.
Finished. rustls is now 0.23.45 (rustls-webpki 0.103.15) and h2 is 0.4.19. Only the lockfile changed: both were already within the allowed version ranges.
An OSV check of the whole lockfile no longer finds RUSTSEC-2026-0285 or RUSTSEC-2026-0258, and finds nothing new. The tests pass, clippy passes with `-D warnings`, a real TLS handshake over Tor to an onion service succeeds, and the Windows cross-build builds.
Running the advisory check automatically, so the next one is caught without an audit, is #256.
- nobilis: https://git.salastil.com/Salastil/nobilis/commit/2f5918e
- moho: https://git.salastil.com/Salastil/moho/commit/810c9a7
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two
unsafeblocks (both sound libc calls inmain.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate inCargo.lock, and each one traced to whether it is actually compiled in.Both are compiled in and both are fixed upstream within the version ranges nobilis already allows -
cargo updateis the fix.cargo update -p [email protected] --precise 0.23.45resolves.Afterwards, re-run the advisory check so the next one is caught by a machine rather than an audit - see the hardening issue.
Finished. rustls is now 0.23.45 (rustls-webpki 0.103.15) and h2 is 0.4.19. Only the lockfile changed: both were already within the allowed version ranges.
An OSV check of the whole lockfile no longer finds RUSTSEC-2026-0285 or RUSTSEC-2026-0258, and finds nothing new. The tests pass, clippy passes with
-D warnings, a real TLS handshake over Tor to an onion service succeeds, and the Windows cross-build builds.Running the advisory check automatically, so the next one is caught without an audit, is #256.