Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
Red Hat Rust tools could let attackers run code
published 15 days ago
Summary
Several Red Hat packages used for developing Rust applications—cargo, clippy, rust, rust-analyzer, and rust-debugger-common—contain a bug that could allow a malicious user to execute unauthorized code. This could compromise the security of systems that build or analyze Rust software. Apply the latest Red Hat update for these packages as soon as possible to close the issue.
What to do
- Update redhat cargo to version 0:1.99.1-1.1.hum1.
- Update redhat clippy to version 0:1.99.1-1.1.hum1.
- Update redhat rust to version 0:1.99.1-1.1.hum1.
- Update redhat rust-analyzer to version 0:1.99.1-1.1.hum1.
- Update redhat rust-debugger-common to version 0:1.99.1-1.1.hum1.
- Update redhat rust-doc to version 0:1.99.1-1.1.hum1.
- Update redhat rust-gdb to version 0:1.99.1-1.1.hum1.
- Update redhat rust-lldb to version 0:1.99.1-1.1.hum1.
- Update redhat rust-src to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-aarch64-unknown-none-softfloat to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-aarch64-unknown-uefi to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-i686-pc-windows-gnu to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-wasm32-unknown-unknown to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-wasm32-wasip1 to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-x86_64-pc-windows-gnu to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-x86_64-unknown-none to version 0:1.99.1-1.1.hum1.
- Update redhat rust-std-static-x86_64-unknown-uefi to version 0:1.99.1-1.1.hum1.
- Update redhat rustfmt to version 0:1.99.1-1.1.hum1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:hummingbird:1 | redhat | cargo |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | clippy |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-analyzer |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-debugger-common |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-doc |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-gdb |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-lldb |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-src |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-aarch64-unknown-none-softfloat |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-aarch64-unknown-uefi |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-i686-pc-windows-gnu |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-wasm32-unknown-unknown |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-wasm32-wasip1 |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-x86_64-pc-windows-gnu |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-x86_64-unknown-none |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rust-std-static-x86_64-unknown-uefi |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
| Red Hat:hummingbird:1 | redhat | rustfmt |
< 0:1.99.1-1.1.hum1 Fix: upgrade to 0:1.99.1-1.1.hum1
|
Original advisory text
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
References
- https://access.redhat.com/errata/RHSA-2026:83879 Vendor Advisory
- https://images.redhat.com/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-109350 Third Party Advisory
- https://access.redhat.com/security/updates/classification/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-109349 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-109351 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83879.... Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2549829 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-109349 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109349 Vendor Advisory
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwg Third Party Advisory
- https://www.vulncheck.com/advisories/gix-pack-before-0.75.0-reachable-assertion-... Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2549792 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-109350 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109350 Vendor Advisory
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-mpf5-465h-mr53 Third Party Advisory
- https://www.vulncheck.com/advisories/gitoxide-gix-pack-before-0.75.0-denial-of-s... Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2549767 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-109351 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109351 Vendor Advisory
- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x862-c2wj-4mwr Third Party Advisory
- https://www.vulncheck.com/advisories/gitoxide-gix-pack-before-0.75.0-denial-of-s... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published20 Oct 2026
Updated20 Oct 2026
First seen20 Oct 2026
Sources
RHSA-2026:83879 · OSV
Track software like this
Free during beta