// stack
Rust
Security incidents affecting rust crates and libraries. Newest first.
- incidents
- 2
- live
- 2
- patched
- 1
## 2 Rust incidents in the last year
through Oct 22, 2026- criticallivepatchedsince Oct 20, 2026
Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
› Signal (RingRTC calling library, @signalapp/ringrtc)
A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0; a conceptual PoC is public, no known exploitation.
CVE-2026-113380 - unknownlivepartial fixsince Oct 20, 2026
HTTP/3 QPACK “Header Accordions” memory-amplification DoS
› HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)
FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.
CVE-2025-64702CVE-2026-12523CVE-2025-13945
