Security: 5 Rust vulnerabilities found by cargo audit (2026-07-31)

[maksym-neboha]

Vulnerability Report — rgb-lightning-node

Date	2026-07-31 08:51 UTC
Repo	https://github.com/RGB-Tools/rgb-lightning-node
Summary	Rust: 5 vulns

---

Table of Contents

• Rust · rgb-lightning-node

---

Rust · rgb-lightning-node

Path	.
DB updated	2026-07-30
Dependencies	598
Vulnerabilities	5
Warnings (unmaintained/unsound)	3

Vulnerabilities

#	ID	Package	Version	Severity	Fix	Title
1	RUSTSEC-2024-0430	magic-crypt	4.0.1	⚪ unknown	❌	Use of insecure cryptographic algorithms
2	RUSTSEC-2023-0071	rsa	0.9.10	🟡 medium	❌	Marvin Attack: potential key recovery through timing sidechannels
3	RUSTSEC-2026-0098	rustls-webpki	0.101.7	⚪ unknown	>=0.103.12, <0.104.0-alpha.1	Name constraints for URI names were incorrectly accepted
4	RUSTSEC-2026-0099	rustls-webpki	0.101.7	⚪ unknown	>=0.103.12, <0.104.0-alpha.1	Name constraints were accepted for certificates asserting a wildcard n
5	RUSTSEC-2026-0104	rustls-webpki	0.101.7	🟠 high	>=0.103.13, <0.104.0-alpha.1	Reachable panic in certificate revocation list parsing

Vulnerability details

RUSTSEC-2024-0430: Use of insecure cryptographic algorithms

Package: magic-crypt 4.0.1
Fix: ❌ no fix
Aliases: GHSA-gmx7-gr5q-85w5

This crate uses a number of cryptographic algorithms that are no longer considered secure and it uses them in ways that do not guarantee the integrity of the encrypted data. MagicCrypt64 uses the insecure DES block cipher in CBC mode without authe…

RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels

Package: rsa 0.9.10
Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c

Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…

RUSTSEC-2026-0098: Name constraints for URI names were incorrectly accepted

Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-965h-392x-2mh5

Name constraints for URI names were ignored and therefore accepted. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented. URI name constraints are now rejected unconditionally. S…

RUSTSEC-2026-0099: Name constraints were accepted for certificates asserting a wildcard name

Package: rustls-webpki 0.101.7
Fix: >=0.103.12, <0.104.0-alpha.1, >=0.104.0-alpha.6
Aliases: GHSA-xgp8-3hg3-c2mh

Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of `reject.example.co…

RUSTSEC-2026-0104: Reachable panic in certificate revocation list parsing

Package: rustls-webpki 0.101.7
Fix: >=0.103.13, <0.104.0-alpha.1, >=0.104.0-alpha.7
Aliases: GHSA-82j2-j2ch-gfr8

A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der] or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty BIT STRING appearing in the `only…

Recommended fixes:

• rustls-webpki → 0.103.13,

cargo update -p rustls-webpki --precise 0.103.13,

No fix available (monitor upstream):

• magic-crypt
• rsa

Warnings

Unmaintained:

Package	Version	Advisory
bincode	1.3.3	RUSTSEC-2025-0141: Bincode is unmaintained
paste	1.0.15	RUSTSEC-2024-0436: paste - no longer maintained
proc-macro-error2	2.0.1	RUSTSEC-2026-0173: proc-macro-error2 is unmaintained

[zoedberg]

Thanks for the report.

Current status:

• magic-crypt: fixed in replace magic-crypt with scrypt and XChaCha20Poly1305 #144

• rsa: fixed in drop the unused sqlx-mysql feature rgb-lib#95. Once RLN updates rgb-lib, this will no longer be a dependency.

• rustls-webpki: the suggested fix cannot be applied directly. The proper fix is to move the esplora/minreq stack off rustls 0.21, which requires a new bdk_esplora release. That work is still in progress upstream: Bump esplora-client to v0.13.0 bitcoindevkit/bdk#2189

  As a mitigation, indexer features + drop default indexer #147 adds separate electrum and esplora features. Using only electrum avoids the rustls-webpki dependency.

• bincode: transitive dependency from bdk_file_store, which became optional in Store BDK wallet data in rgb-lib database rgb-lib#104

• paste: RLN reaches it through two independent paths: rgb-aluvm declares it as a direct dependency, and amplify pulls it in through stringly_conversions whenever its serde feature is enabled. remove unmaintained paste dependency rgb-protocol/rgb-aluvm#7 closes both for rgb-aluvm. Other amplify/serde removals are being made in rgb-strict-encoding (drop amplify/serde: avoid unmaintained paste dep rgb-protocol/rgb-strict-encoding#5), rgb-strict-types (drop amplify/serde: avoid unmaintained paste dep rgb-protocol/rgb-strict-types#3), rgb-consensus (drop amplify/serde: avoid unmaintained paste dep rgb-protocol/rgb-consensus#15) and rgb-ops (drop amplify/serde: avoid unmaintained paste dep rgb-protocol/rgb-ops#17); together those are the only crates in RLN's tree that enable it, so once they are released and rgb-lib is updated, RLN will no longer depend on paste

• proc-macro-error2: transitive dependency from:

  • biscuit-auth: fixed upstream in move from proc-macro-error2 to manyhow (fix RUSTSEC-2026-0173) eclipse-biscuit/biscuit-rust#333; waiting for a crates.io release.
  • sea-orm: addressed in update sea-orm rgb-lib#96