From a memory-safety audit of nobilis on 2 October 2026: its own code has two unsafe blocks (both sound libc calls in main.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in Cargo.lock, and each one traced to whether it is actually compiled in.
Discord voice and Go Live are end-to-end encrypted with DAVE (davey <- openmls_rust_crypto <- hpke-rs), which brings in libcrux at versions with published advisories:
libcrux-sha3 0.0.8 - RUSTSEC-2026-0207, incorrect output of the incremental portable SHAKE API on multiple squeeze calls, and RUSTSEC-2026-0208, potential panic in AVX2 SHAKE-256. Fixed in 0.0.10.
libcrux-secrets 0.0.5 - RUSTSEC-2026-0212, potentially incorrect output of constant-time swap/select on aarch64. Fixed in 0.0.6. (Matters for an ARM build, which there is not yet.)
Not compiled in, so not this issue: libcrux-aesgcm and libcrux-chacha20poly1305 (also flagged) sit behind libcrux-aead, which nothing in the build enables.
hpke-rs 0.6.1 pins the older libcrux, so the fix is a newer davey / openmls_rust_crypto / hpke-rs. A wrong hash in DAVE is at best a call that cannot decrypt and at worst a weaker one; a panic in it ends the call. Done when the advisories are gone and a call and a stream still work both ways.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two `unsafe` blocks (both sound libc calls in `main.rs`), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate in `Cargo.lock`, and each one traced to whether it is actually compiled in.
Discord voice and Go Live are end-to-end encrypted with DAVE (`davey` <- `openmls_rust_crypto` <- `hpke-rs`), which brings in libcrux at versions with published advisories:
- **libcrux-sha3 0.0.8** - RUSTSEC-2026-0207, *incorrect output of the incremental portable SHAKE API on multiple squeeze calls*, and RUSTSEC-2026-0208, *potential panic in AVX2 SHAKE-256*. Fixed in 0.0.10.
- **libcrux-secrets 0.0.5** - RUSTSEC-2026-0212, *potentially incorrect output of constant-time swap/select on aarch64*. Fixed in 0.0.6. (Matters for an ARM build, which there is not yet.)
Not compiled in, so not this issue: `libcrux-aesgcm` and `libcrux-chacha20poly1305` (also flagged) sit behind `libcrux-aead`, which nothing in the build enables.
`hpke-rs` 0.6.1 pins the older libcrux, so the fix is a newer `davey` / `openmls_rust_crypto` / `hpke-rs`. A wrong hash in DAVE is at best a call that cannot decrypt and at worst a weaker one; a panic in it ends the call. Done when the advisories are gone and a call and a stream still work both ways.
Salastil
added this to the v1.0 milestone 2026-10-02 19:03:38 -04:00
Salastil
added the bugCVE labels 2026-10-02 19:03:38 -04:00
Salastil
removed this from the v1.0 milestone 2026-10-03 21:31:24 -04:00
So it needs either a davey release on openmls_rust_crypto 0.6, or a patched davey vendored here ([patch.crates-io], as with saturating-time) that builds against it. Then a Discord call and a Go Live stream need testing both ways.
Looked into this on 4 October; parked rather than fixed. This isn't a `cargo update`:
- `hpke-rs` 0.6.1 requires `libcrux-sha3 = "0.0.8"`, which for a `0.0.x` version means exactly 0.0.8.
- The fixed libcrux arrives with `hpke-rs` 0.7.0, which comes with `openmls_rust_crypto` 0.6.0.
- `davey` 0.1.4, the newest release, requires `openmls_rust_crypto` 0.5.1 (and `openmls` 0.8.1).
So it needs either a `davey` release on `openmls_rust_crypto` 0.6, or a patched `davey` vendored here (`[patch.crates-io]`, as with saturating-time) that builds against it. Then a Discord call and a Go Live stream need testing both ways.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From a memory-safety audit of nobilis on 2 October 2026: its own code has two
unsafeblocks (both sound libc calls inmain.rs), so what follows is about the code it depends on. Advisories were checked against the OSV/RustSec database for every crate inCargo.lock, and each one traced to whether it is actually compiled in.Discord voice and Go Live are end-to-end encrypted with DAVE (
davey<-openmls_rust_crypto<-hpke-rs), which brings in libcrux at versions with published advisories:Not compiled in, so not this issue:
libcrux-aesgcmandlibcrux-chacha20poly1305(also flagged) sit behindlibcrux-aead, which nothing in the build enables.hpke-rs0.6.1 pins the older libcrux, so the fix is a newerdavey/openmls_rust_crypto/hpke-rs. A wrong hash in DAVE is at best a call that cannot decrypt and at worst a weaker one; a panic in it ends the call. Done when the advisories are gone and a call and a stream still work both ways.Looked into this on 4 October; parked rather than fixed. This isn't a
cargo update:hpke-rs0.6.1 requireslibcrux-sha3 = "0.0.8", which for a0.0.xversion means exactly 0.0.8.hpke-rs0.7.0, which comes withopenmls_rust_crypto0.6.0.davey0.1.4, the newest release, requiresopenmls_rust_crypto0.5.1 (andopenmls0.8.1).So it needs either a
daveyrelease onopenmls_rust_crypto0.6, or a patcheddaveyvendored here ([patch.crates-io], as with saturating-time) that builds against it. Then a Discord call and a Go Live stream need testing both ways.