Loading story…
Cryptographer Nadim Kobeissi has accused maintainers of the RustSec advisory database and related Rust governance bodies of blocking or suppressing security advisories for vulnerabilities he reported in Rust cryptography libraries, including hpke-rs and libcrux-related code. He said one hpke-rs flaw could trigger AES-GCM nonce reuse, enabling plaintext recovery and message forgery, while another issue could cause denial of service. Kobeissi argued the affected code had downstream relevance to projects such as Signal, OpenMLS, Google, SSH, and the Linux kernel, and he escalated complaints to the Rust Moderation Team, Leadership Council, and later the Rust Foundation after being banned from Rust Project Zulip spaces.
The dispute has widened into a fight over both vulnerability severity and open-source governance. Cryspen acknowledged shortcomings in how advisories were handled but said bugs in its pre-release software were fixed within a week, while cryptographer Filippo Valsorda disputed Kobeissi’s characterization of the issues as broadly critical and said his conduct was disproportionate and potentially harassing. Reporting and commentary around the case have framed it as an integrity challenge for RustSec, with the controversy focusing on whether dangerous crypto flaws were downplayed and whether disclosure, moderation, and conflict-of-interest processes in the Rust ecosystem were handled properly.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Amid the disclosure dispute, Kobeissi was banned from Rust Project Zulip spaces. He characterized the action as retaliatory in subsequent complaints to Rust governance bodies.
Kobeissi accused RustSec maintainers and related Rust governance bodies of blocking or suppressing publication of advisories for the reported flaws. He then filed complaints with the Rust Moderation Team, the Leadership Council, and later the Rust Foundation, alleging retaliation, conflicts of interest, and Code of Conduct violations.
According to Cryspen, the reported bugs in its pre-release software were remediated within a week of being raised. This was presented as part of its response to criticism over how the advisories were handled.
Cryptographer Nadim Kobeissi reported security flaws affecting Rust cryptography libraries including hpke-rs and libcrux-related code. He said one hpke-rs issue could cause AES-GCM nonce reuse enabling plaintext recovery and forgery, and another could lead to denial of service.
Reports published in March 2026 brought the conflict into public view, describing both the alleged suppression of advisories and disagreement over the severity and impact of the reported cryptographic issues. Cryptographer Filippo Valsorda publicly disputed Kobeissi’s characterization of the flaws as broadly critical and criticized his conduct.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**OpenClaw**, a self-hosted AI agent that rapidly became GitHub’s most-starred repository, triggered an unusual surge of vulnerability disclosures that exposed friction between **GitHub Security Advisories (GHSAs)** and the traditional **CVE** assignment pipeline. In late February, OpenClaw published **200+ GHSAs within roughly three weeks** (with reports citing **~255 total advisories**), covering issues such as command execution controls, authorization checks, allowlist enforcement, and plugin boundary weaknesses; many advisories lacked corresponding CVE identifiers due to the volume outpacing normal CVE processing. The situation escalated when vulnerability intelligence firm **VulnCheck** asked the CVE Project researcher working group to call **“DIBS”** on **170 OpenClaw advisories** without CVE IDs—an informal CNA coordination signal indicating intent to evaluate and potentially assign CVEs—citing customer demand and a desire to ensure coverage “before they are weaponized.” The request prompted pushback within the CVE community (including from MITRE’s TL-Root) that **DIBS is intended for individual vulnerabilities meeting defined criteria**, not as a mechanism to broadly categorize or preemptively claim large sets of supplier advisories; separately, a podcast episode referenced an “OpenClaw bot” allegedly moving from research into malicious activity, but provided insufficient detail to corroborate or connect it to the GHSA/CVE tracking dispute.
Jun 29, 2026
The Rust project has warned that attackers are actively targeting prominent community members and maintainers of popular `crates.io` packages in an apparent effort to compromise accounts and publish malware through trusted Rust crates. The attackers use credible-looking fictitious company websites and LinkedIn profiles to approach targets with seemingly legitimate job, project, or contract opportunities and arrange video calls. During the calls, the operators pressure targets to install a supposed missing audio codec or run commands, including commands copied through the clipboard, to gain access to devices or maintainer accounts. Rust advised maintainers to treat unsolicited outreach with skepticism, use trusted conferencing platforms, and review MFA and account-login activity; reporting has linked the tactic to prior DPRK-associated activity, including the brief compromise of the `arrayref` crate, though attribution for the current campaign is unconfirmed.
Sep 21, 2026
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026