RGB-Tools / RGB-Tools/rgb-lightning-node
Security: 5 Rust vulnerabilities found by cargo audit (2026-07-31)
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 50
- Forks
- 48
- Avg merge
- 8h 52m
- Merged PRs (30d)
- 2
Description
Vulnerability Report — rgb-lightning-node
| Date | 2026-07-31 08:51 UTC |
| Repo | https://github.com/RGB-Tools/rgb-lightning-node |
| Summary | Rust: 5 vulns |
Table of Contents
- Rust · rgb-lightning-node
Rust · rgb-lightning-node
| Path | . |
| DB updated | 2026-07-30 |
| Dependencies | 598 |
| Vulnerabilities | 5 |
| Warnings (unmaintained/unsound) | 3 |
Vulnerabilities
| # | ID | Package | Version | Severity | Fix | Title |
|---|---|---|---|---|---|---|
| 1 | RUSTSEC-2024-0430 | magic-crypt |
4.0.1 |
⚪ unknown | ❌ |
Use of insecure cryptographic algorithms |
| 2 | RUSTSEC-2023-0071 | rsa |
0.9.10 |
🟡 medium | ❌ |
Marvin Attack: potential key recovery through timing sidechannels |
| 3 | RUSTSEC-2026-0098 | rustls-webpki |
0.101.7 |
⚪ unknown | >=0.103.12, <0.104.0-alpha.1 |
Name constraints for URI names were incorrectly accepted |
| 4 | RUSTSEC-2026-0099 | rustls-webpki |
0.101.7 |
⚪ unknown | >=0.103.12, <0.104.0-alpha.1 |
Name constraints were accepted for certificates asserting a wildcard n |
| 5 | RUSTSEC-2026-0104 | rustls-webpki |
0.101.7 |
🟠 high | >=0.103.13, <0.104.0-alpha.1 |
Reachable panic in certificate revocation list parsing |
Vulnerability details
RUSTSEC-2024-0430: Use of insecure cryptographic algorithms
Package: magic-crypt 4.0.1
Fix: ❌ no fix
Aliases: GHSA-gmx7-gr5q-85w5
This crate uses a number of cryptographic algorithms that are no longer considered secure and it uses them in ways that do not guarantee the integrity of the encrypted data. MagicCrypt64 uses the insecure DES block cipher in CBC mode without authe…
RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels
Package: rsa 0.9.10
Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c
Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…
RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted
Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-965h-392x-2mh5
Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…
RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name
Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-xgp8-3hg3-c2mh
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of `reject.example.co…
RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing
Package: rustls-webpki 0.101.7
Fix: >=0.103.13, <0.104.0-alpha.1, >=0.104.0-alpha.7
Aliases: GHSA-82j2-j2ch-gfr8
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the `only…
Recommended fixes:
rustls-webpki→0.103.13,
cargo update -p rustls-webpki --precise 0.103.13,
No fix available (monitor upstream):
magic-cryptrsa
Warnings
Unmaintained:
| Package | Version | Advisory |
|---|---|---|
bincode |
1.3.3 |
RUSTSEC-2025-0141: Bincode is unmaintained |
paste |
1.0.15 |
RUSTSEC-2024-0436: paste - no longer maintained |
proc-macro-error2 |
2.0.1 |
RUSTSEC-2026-0173: proc-macro-error2 is unmaintained |
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the repository root (.) by reviewing the Cargo dependency configuration and running cargo audit to confirm the reported packages. Apply the stated rustls-webpki update to 0.103.13, rerun the audit, and document or monitor magic-crypt and rsa, which have no available fix.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100