crates.io Package Vulnerabilities
Vulnerabilities associated with hubuum_client.
Packages
Clear package- surrealdb52 vulnerabilities
- wasmtime39 vulnerabilities
- deno37 vulnerabilities
- zebrad27 vulnerabilities
- openssl-src26 vulnerabilities
- ckb22 vulnerabilities
- coreutils21 vulnerabilities
- openssl18 vulnerabilities
- rusqlite16 vulnerabilities
- russh15 vulnerabilities
- apollo-router13 vulnerabilities
- rustfs13 vulnerabilities
- tough10 vulnerabilities
- cargo8 vulnerabilities
- gix8 vulnerabilities
- surrealdb-core8 vulnerabilities
- gitoxide7 vulnerabilities
- hyper7 vulnerabilities
- pyo37 vulnerabilities
- routinator7 vulnerabilities
- vaultwarden7 vulnerabilities
- Simple-Wayland-HotKey-Daemon6 vulnerabilities
- astral-tokio-tar6 vulnerabilities
- cranelift-codegen6 vulnerabilities
- deno_runtime6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics## Summary `hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. ## Affected behavior Native `reqwest::Error` values retain the full request URL. Converting those errors into `ApiError::Http`, or exhausting retries and storing the error text in `ApiError::RetryExhausted`, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided me… CWE-532Jul 24, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic## Summary When an application configures hubuum_client with ClientBuilder::with_transport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-output downloads, and unified-search streams. ## Impact Applications may use a custom transport as a security boundary for network isolation, proxy enforcement, request signing, audit logging, or pol… CWE-693Jul 24, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects## Impact The built-in async and blocking clients used reqwest's default redirect policy. `BaseUrl` constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer `Authorization` header outside the configured Hubuum path pref… CWE-200Jul 24, 2026 | CVSS-v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |