rustsec / rustsec/advisory-db

RUSTSEC-2026-0244 is assigned to two crates, so cargo-audit cannot load the database at all

Open Beginner friendly
#3,131 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
1.2k
Forks
544
Avg merge
1d 10h
Merged PRs (30d)
45

Description

Since #3128 the advisory ID RUSTSEC-2026-0244 exists in two files:

crates/gettext-rs/RUSTSEC-2026-0244.md
crates/gettext-sys/RUSTSEC-2026-0244.md

That PR moved the advisory to gettext-sys but the copy under gettext-rs
was not removed, so both are present on main (currently 565436d8).

cargo-audit refuses to load the database when it sees a duplicate ID, which
means every cargo audit run fails, not only ones involving gettext:

    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
error: error loading advisory database: parse error: duplicate advisory ID: RUSTSEC-2026-0244
Reproducing
cargo audit

on any project. Or directly:

ls ~/.cargo/advisory-db/crates/gettext-{rs,sys}/RUSTSEC-2026-0244.md
Impact

This is a hard failure rather than a warning, so it blocks any CI step or
pre-push hook that runs cargo audit. We hit it on several repositories today;
in one of them the pre-push gate refuses the push entirely, with 22 of 23
checks passing and only the advisory step failing.

Fix

Delete crates/gettext-rs/RUSTSEC-2026-0244.md, keeping the gettext-sys one
that #3128 intended.

Happy to open that PR if it is useful.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting crates/gettext-rs/RUSTSEC-2026-0244.md and the corresponding crates/gettext-sys/RUSTSEC-2026-0244.md entry. Run cargo audit or inspect the advisory database to reproduce the duplicate-ID parse error. Done means only the intended gettext-sys advisory remains and cargo audit loads the database successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.