🔐 Security Scan — 2026-09-19

[maksym-neboha]

Vulnerability Report — RTR

Date	2026-09-19 11:50 UTC
Repo	https://github.com/UTEXO-Protocol/RTR
Summary	Rust: 2 vulns

---

Table of Contents

• Rust · rtr

---

Rust · rtr

Path	.
DB updated	2026-09-19
Dependencies	286
Vulnerabilities	2
Warnings (unmaintained/unsound)	0

Vulnerabilities

#	ID	Package	Version	Severity	Fix	Title
1	RUSTSEC-2023-0071	rsa	0.9.10	🟡 medium	❌	Marvin Attack: potential key recovery through timing sidechannels
2	RUSTSEC-2026-0285	rustls	0.23.43	🟡 medium	>=0.23.45	TLS 1.3 handshake messages incorrectly accepted across encryption leve

Vulnerability details

RUSTSEC-2023-0071: Marvin Attack: potential key recovery through timing sidechannels

Package: rsa 0.9.10
Fix: ❌ no fix
Aliases: CVE-2023-49092, GHSA-c38w-74pg-36hr, GHSA-4grx-2x9w-596c

Impact Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key. ### Patches No pat…

RUSTSEC-2026-0285: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Package: rustls 0.23.43
Fix: >=0.23.45
Aliases: GHSA-2mjx-qc3c-rqvc

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. For example, a plaintext EncryptedExtensions message packed into the same record as the ServerHello was ac…

Recommended fixes:

• rustls → 0.23.45

cargo update -p rustls --precise 0.23.45

No fix available (monitor upstream):

• rsa