Critical Denial of Service Vulnerability in Rust Package - CVE-2026-53587
Summary
RLSA-2026:67286: Important: rust security update. Affects rust versions < 0:1.92.0-2.el10_2. Fixed in 0:1.92.0-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rust is a systems programming language known for its performance, memory safety, and concurrency. It is widely used for building reliable and efficient software. The Rust package includes the Rust compiler and documentation generator, making it essential for developers working in various domains. However, it has been found vulnerable to a Denial of Service (DoS) attack due to a heap out-of-bounds read when interacting with a malicious Git server.
Vulnerability Detail
The vulnerability identified as CVE-2026-53587 allows an attacker to exploit a flaw in the libgit2 library used by Rust. This flaw can lead to a Denial of Service condition, where the application becomes unresponsive or crashes. The root cause of this vulnerability is an out-of-bounds read in the heap memory, which can be triggered by specially crafted Git data from a malicious server. The potential ramifications include service downtime and disruption of applications relying on the Rust package for Git operations.
How To Fix
Minimum fixed version
0:1.92.0-2.el10_2
This is the first release that contains the fix.
sudo dnf update rustTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid connecting to untrusted or malicious Git servers while using the Rust package. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The Rust package has a critical vulnerability (CVE-2026-53587) that can lead to Denial of Service attacks. It is crucial for users to update their Rust installations to the latest patched version to mitigate this risk. Additionally, employing safe practices when interacting with Git servers can help reduce exposure to potential exploits.
See every vulnerability recorded for rust →
FAQ
CVE-2026-53587 is a critical vulnerability in the Rust package that can lead to Denial of Service due to a heap out-of-bounds read.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, avoid using untrusted Git servers to reduce the risk of exploitation.
The Rocky Enterprise Software Foundation and Red Hat are responsible for addressing and providing updates for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for rust.
