Use-after-free of caller-owned server name in client connection constructors
crates.io rustls-ffi · Upgrade to 0.15.7 or later · >= 0.12.0, < 0.15.7 · GHSA-rc3f-4j82-cmrg
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–4 of 4 matching · newest first
crates.io rustls-ffi · Upgrade to 0.15.7 or later · >= 0.12.0, < 0.15.7 · GHSA-rc3f-4j82-cmrg
crates.io cargo-nextest · Upgrade to 0.9.150 or later · >= 0.9.125, < 0.9.150 · GHSA-vc25-qg58-w57c
Bitnami parse · Upgrade to 9.10.3 or 8.6.98 by release line · < 8.6.98; >= 9.0.0, < 9.10.3 · CVE-2026-112769 · GHSA-gj37-5hg5-p729
Bitnami parse · Upgrade to 9.10.3 or 8.6.99 by release line · < 8.6.99; >= 9.0.0, < 9.10.3 · CVE-2026-112768 · GHSA-p49q-9w65-f9p7
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.