Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

qcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9crates.ioPublished

    qcp has possible crash/DOS in some build configurations

    GHSA-fmwf-c46w-r8qm

    Affected
    • crates.io qcp < 0.3.3
    Fixed in
    0.3.3· Vendor fix available
    Issue
    Nature of issue: Crash (Denial of Service) Source of issue: Dependent package (ring) Affected versions of qcp: 0.1.0-0.3.2 Recommendation: Upgrade to qcp 0.3.3 or later Who is affected All versions of qcp from 0.1.0 to 0.3.2 are affected, but only if built with runtime overflow checks. Released qcp binaries do not enable runtime overflow checks by default. If you use an official released qcp binary download, you are not affected. If you built qcp yourself in debug mode, you are affected unless your debug configuration explicitly disables overflow checks. If you built qcp yourself in release mode, you are only affected if you explicitly requested runtime overflow checks at build time by setting the appropriate RUSTFLAGS, or in your Cargo.toml profile. What to do if you are affected We recommend you upgrade to qcp 0.3.3 or later. Users upgrading from versions prior to 0.3.0 should note that an incompatible protocol change was introduced in version 0.3.0, so should stage their upgrade…

    Recommended action: Upgrade to 0.3.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →