{ "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json", "document": { "category": "csaf_security_advisory", "csaf_version": "2.1", "distribution": { "tlp": { "label": "CLEAR" } }, "lang": "en", "notes": [ { "category": "summary", "text": "ndaal SARIF Viewer 1.1.11 is affected by RUSTSEC-2026-0258 (GHSA-q83h-524g-xf6h). ndaal SARIF Viewer 1.1.12 remediates it by advancing the `hyper` dependency 1.10.1 -> 1.11.1 in the 2026-09-16 `cargo update` sweep. CVSS v3.1 base score 3.7 (LOW). Users of 1.1.11 and earlier releases resolving the affected version should upgrade to 1.1.12.", "title": "Summary" }, { "category": "description", "text": "The h2 crate used internally by hyper accepted and queued empty HTTP/2 DATA frames without any limit. Against a peer that does not actively drain its streams this grows memory without bound, and a length overflow can panic the process -- a denial of service against the viewer's listener, reachable by any client able to open an HTTP/2 connection to it. sarif-viewer 1.1.11 resolved h2 0.4.15 and is therefore affected; the sweep moves it to 0.4.19, past the 0.4.16 patch. No confidentiality or integrity impact: the flaw exhausts resources, it does not expose or alter data.", "title": "Impact" }, { "category": "general", "text": "Upstream publishes NO CVSS vector for RUSTSEC-2026-0258 and rates it textually as \"Low severity\". The vector recorded here is therefore ndaal's own assessment for this product and is labelled as such: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 3.7 (LOW), which keeps ndaal's rating consistent with the upstream wording. AC:H records that exploitation depends on stream-draining behaviour the attacker does not control; impact is availability-only and LOW because the viewer is an offline, typically single-operator tool rather than a shared service. The v4.0 vector is derived from this v3.1 vector by the repository's documented mapping, and computes 6.3 (MEDIUM) rather than LOW: CVSS 4.0 weights an unauthenticated, network-reachable availability impact considerably higher than CVSS 3.1 does for the same metric values. That divergence is a property of the two scoring systems, not a second opinion -- ndaal's judgement of this flaw is the LOW rating carried by the v3.1 vector, matching upstream's wording.", "title": "CVSS Scoring Rationale" }, { "category": "general", "text": "hyper provides the HTTP server and client core; the viewer's listener is built on hyper_util::server::conn::auto::Builder with http2() configured (src/server.rs:101-106), so HTTP/2 is negotiated on the network-reachable surface and the h2 stack beneath hyper is reachable -- not merely compiled in. Dependency kind: direct, [dependencies]. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"1\" (features http1, server, client); lockfile-only change. The security-relevant part of this bump is the transitive h2 advance it permits. Folds h2 0.4.15 -> 0.4.19 -- the crate actually carrying the fix, patched upstream in 0.4.16 -- together with http-body 1.0.1 -> 1.1.0 and the futures-* family 0.3.32 -> 0.3.34 in the same subtree. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.", "title": "Dependency Change" }, { "category": "general", "text": "sarif-viewer is a secure, memory-safe, single-binary offline viewer, validator and multi-format exporter for SARIF 2.1.0 and SARIF 2.2 (draft). Imported runs are validated against the vendored OASIS schemas (jsonschema) and served from an embedded UI over a TLS 1.3 listener (rustls with the aws-lc-rs provider and prefer-post-quantum key exchange) that speaks HTTP/1.1 and HTTP/2 through hyper-util's auto builder (src/server.rs) and HTTP/3 through h3 over quinn. Filesystem access for import, export and checksum sidecars is confined with cap-std. Its network-reachable request parsing surface, its TLS termination, and its supply chain are on the primary trust boundary.", "title": "Product Description" }, { "category": "legal_disclaimer", "text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.", "title": "Legal Disclaimer" } ], "publisher": { "category": "vendor", "contact_details": "security@ndaal.eu", "issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team", "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG", "namespace": "https://ndaal.eu/csaf" }, "references": [ { "category": "self", "summary": "This advisory in CSAF 2.1 format", "url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/630/ndaal-sa-2026-630.json" }, { "category": "external", "summary": "sarif-viewer source code", "url": "https://gitlab.com/vPierre/ndaal_public_sarif_viewer" }, { "category": "external", "summary": "sarif-viewer on crates.io", "url": "https://crates.io/crates/sarif-viewer" }, { "category": "external", "summary": "hyper 1.11.1 on crates.io", "url": "https://crates.io/crates/hyper/1.11.1" }, { "category": "external", "summary": "RUSTSEC-2026-0258 in the RustSec advisory database", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0258" }, { "category": "external", "summary": "Upstream advisory GHSA-q83h-524g-xf6h", "url": "https://github.com/advisories/GHSA-q83h-524g-xf6h" } ], "title": "ndaal Security Advisory: RUSTSEC-2026-0258 remediated in sarif-viewer 1.1.12 via hyper 1.10.1 -> 1.11.1", "tracking": { "current_release_date": "2026-09-16T12:00:00.000Z", "generator": { "engine": { "name": "ndaal CSAF Generator", "version": "1.0.0" } }, "id": "ndaal-sa-2026-630", "initial_release_date": "2026-09-16T12:00:00.000Z", "revision_history": [ { "date": "2026-09-16T12:00:00.000Z", "number": "1.0.0", "summary": "RUSTSEC-2026-0258 remediated via hyper 1.10.1 -> 1.11.1; CVSS v3.1 3.7 (LOW)" } ], "status": "final", "version": "1.0.0" }, "x_extensions": [ { "$schema": "https://ndaal.eu/.well-known/csaf/extensions/dashboard-branding_1.0.0.json", "category": "informational", "content": { "dashboard_short_name": "ndaal", "publisher_brand": "ndaal Advisories Database" }, "critical": false } ] }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "1.1.11", "product": { "name": "ndaal SARIF Viewer 1.1.11", "product_id": "CSAFPID-0001", "product_identification_helper": { "purls": [ "pkg:cargo/sarif-viewer@1.1.11" ] } } }, { "category": "product_version", "name": "1.1.12", "product": { "name": "ndaal SARIF Viewer 1.1.12", "product_id": "CSAFPID-0002", "product_identification_helper": { "purls": [ "pkg:cargo/sarif-viewer@1.1.12" ] } } } ], "category": "product_name", "name": "sarif-viewer" } ], "category": "vendor", "name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG" } ] }, "vulnerabilities": [ { "cwes": [ { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling", "version": "4.18" } ], "ids": [ { "system_name": "RustSec Advisory Database", "text": "RUSTSEC-2026-0258" }, { "system_name": "GitHub Security Advisory", "text": "GHSA-q83h-524g-xf6h" }, { "system_name": "ndaal Advisory ID", "text": "ndaal-sa-2026-630" } ], "metrics": [ { "content": { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "cvss_v4": { "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE" } }, "products": [ "CSAFPID-0001" ] } ], "notes": [ { "category": "summary", "text": "ndaal SARIF Viewer 1.1.11 is affected by RUSTSEC-2026-0258 (GHSA-q83h-524g-xf6h). ndaal SARIF Viewer 1.1.12 remediates it by advancing the `hyper` dependency 1.10.1 -> 1.11.1 in the 2026-09-16 `cargo update` sweep. CVSS v3.1 base score 3.7 (LOW). Users of 1.1.11 and earlier releases resolving the affected version should upgrade to 1.1.12.", "title": "Change Summary" }, { "category": "description", "text": "The h2 crate used internally by hyper accepted and queued empty HTTP/2 DATA frames without any limit. Against a peer that does not actively drain its streams this grows memory without bound, and a length overflow can panic the process -- a denial of service against the viewer's listener, reachable by any client able to open an HTTP/2 connection to it. sarif-viewer 1.1.11 resolved h2 0.4.15 and is therefore affected; the sweep moves it to 0.4.19, past the 0.4.16 patch. No confidentiality or integrity impact: the flaw exhausts resources, it does not expose or alter data.", "title": "Impact" }, { "category": "description", "text": "Upstream publishes NO CVSS vector for RUSTSEC-2026-0258 and rates it textually as \"Low severity\". The vector recorded here is therefore ndaal's own assessment for this product and is labelled as such: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, base score 3.7 (LOW), which keeps ndaal's rating consistent with the upstream wording. AC:H records that exploitation depends on stream-draining behaviour the attacker does not control; impact is availability-only and LOW because the viewer is an offline, typically single-operator tool rather than a shared service. The v4.0 vector is derived from this v3.1 vector by the repository's documented mapping, and computes 6.3 (MEDIUM) rather than LOW: CVSS 4.0 weights an unauthenticated, network-reachable availability impact considerably higher than CVSS 3.1 does for the same metric values. That divergence is a property of the two scoring systems, not a second opinion -- ndaal's judgement of this flaw is the LOW rating carried by the v3.1 vector, matching upstream's wording. CVSS v3.1 base score 3.7 (LOW), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. CVSS v4.0 base score 6.3 (MEDIUM), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N.", "title": "CVSS Scoring Rationale" }, { "category": "details", "text": "hyper provides the HTTP server and client core; the viewer's listener is built on hyper_util::server::conn::auto::Builder with http2() configured (src/server.rs:101-106), so HTTP/2 is negotiated on the network-reachable surface and the h2 stack beneath hyper is reachable -- not merely compiled in. Dependency kind: direct, [dependencies]. Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"1\" (features http1, server, client); lockfile-only change. The security-relevant part of this bump is the transitive h2 advance it permits. Folds h2 0.4.15 -> 0.4.19 -- the crate actually carrying the fix, patched upstream in 0.4.16 -- together with http-body 1.0.1 -> 1.1.0 and the futures-* family 0.3.32 -> 0.3.34 in the same subtree. Verification after the sweep, on the resolved lockfile: `cargo check --all-targets` is clean (exit code 0) and `cargo audit` reports 0 vulnerabilities across 350 crate dependencies, down from 2 on the pre-sweep lockfile (the remaining output is the allowed RUSTSEC-2026-0192 unmaintained warning for ttf-parser 0.25.1, which this sweep does not change). The local RUSTSEC advisory database (1246 advisories) reports no advisory against either the old or the new version of this crate, except where an advisory is named explicitly above. The full `cargo test` suite was NOT re-run as part of this sweep and is therefore not asserted here.", "title": "Dependency Change" } ], "product_status": { "fixed": [ "CSAFPID-0002" ], "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "RUSTSEC-2026-0258 in the RustSec advisory database", "url": "https://rustsec.org/advisories/RUSTSEC-2026-0258" }, { "category": "external", "summary": "Upstream advisory GHSA-q83h-524g-xf6h", "url": "https://github.com/advisories/GHSA-q83h-524g-xf6h" } ], "remediations": [ { "category": "vendor_fix", "details": "Upgrade to ndaal SARIF Viewer 1.1.12, which resolves hyper 1.11.1 (from 1.10.1). Picked up via `cargo update` within the existing (unchanged) Cargo.toml requirement \"1\" (features http1, server, client); lockfile-only change. The security-relevant part of this bump is the transitive h2 advance it permits.", "product_ids": [ "CSAFPID-0001" ] } ], "title": "Unbounded queuing of empty HTTP/2 DATA frames in h2, reached through hyper (RUSTSEC-2026-0258)" } ] }