CGA-QFJ4-J4GM-V9Q6: atuin
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-QFJ4-J4GM-V9Q6 is a vulnerability in atuin with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard96 products
- atuin< 18.8.0-r1
- berg< 0.4.11-r2
- bootupd< 0.2.29-r3
- buck2< 20250401-r4
- cargo-audit< 0.21.2-r7
- cargo-audit-doc< 0.21.2-r7
- cargo-c< 0.10.15-r1
- jujutsu< 0.32.0-r2
- jujutsu-docs< 0.32.0-r2
- kdash< 0.6.2-r8
- libwasmtime< 36.0.2-r1
- linkerd-extension-init< 0.1.7-r1
- linkerd-network-validator< 0.1.4-r1
- linkerd2< 25.8.5-r1
- linkerd2-cli< 25.8.5-r1
- linkerd2-cni-plugin< 1.6.4-r1
- linkerd2-cni-plugin-compat< 1.6.4-r1
- linkerd2-cni-repair-controller< 1.6.4-r1
- linkerd2-cni-repair-controller-compat< 1.6.4-r1
- linkerd2-controller< 25.8.5-r1
- linkerd2-controller-compat< 25.8.5-r1
- linkerd2-debug< 25.8.5-r1
- linkerd2-metrics-api< 25.8.5-r1
- linkerd2-metrics-api-compat< 25.8.5-r1
- linkerd2-policy-controller< 25.8.5-r1
- linkerd2-proxy< 2.316.0-r1
- linkerd2-proxy-identity< 25.8.5-r1
- linkerd2-tap< 25.8.5-r1
- linkerd2-tap-compat< 25.8.5-r1
- linkerd2-web< 25.8.5-r1
- mountpoint-s3< 1.19.0-r2
- mountpoint-s3-compat< 1.19.0-r2
- ntpd-rs< 1.6.2-r1
- oranda< 0.6.5-r10
- parseable< 2.4.2-r1
- pgcat< 1.2.0-r6
- pixi< 0.53.0-r1
- pixi-compat< 0.53.0-r1
- py3-supported-hf-xet< 1.1.9-r1
- py3-supported-uv-build< 0.8.14-r1
- py3-xet-core< 1.1.9-r1
- py3.10-hf-xet< 1.1.9-r1
- py3.10-uv-build< 0.8.14-r1
- py3.10-uv-build-bin< 0.8.14-r1
- py3.11-hf-xet< 1.1.9-r1
- py3.11-uv-build< 0.8.14-r1
- py3.11-uv-build-bin< 0.8.14-r1
- py3.12-hf-xet< 1.1.9-r1
- py3.12-uv-build< 0.8.14-r1
- py3.12-uv-build-bin< 0.8.14-r1
- py3.13-hf-xet< 1.1.9-r1
- py3.13-uv-build< 0.8.14-r1
- py3.13-uv-build-bin< 0.8.14-r1
- qdrant< 1.15.4-r1
- qdrant-oci-compat< 1.15.4-r1
- qdrant-oci-entrypoint< 1.15.4-r1
- ruff< 0.12.11-r1
- ruff-python-formatter< 0.12.11-r1
- rust-analyzer< 20250825-r1
- rustup< 1.28.2-r2
- shadowsocks-rust< 1.23.5-r3
- shadowsocks-rust-sslocal< 1.23.5-r3
- shadowsocks-rust-ssmanager< 1.23.5-r3
- shadowsocks-rust-ssserver< 1.23.5-r3
- shadowsocks-rust-ssservice< 1.23.5-r3
- shadowsocks-rust-ssurl< 1.23.5-r3
- toda< 0.2.4-r4
- topgrade< 16.0.4-r3
- topgrade-bash-completion< 16.0.4-r3
- topgrade-doc< 16.0.4-r3
- topgrade-fish-completion< 16.0.4-r3
- topgrade-zsh-completion< 16.0.4-r3
- uv< 0.8.14-r1
- wadm< 0.21.0-r4
- wash< 0.39.0-r5
- wasmcloud< 1.9.0-r1
- wasmtime< 36.0.2-r1
- wasmtime-dev< 36.0.2-r1
- yazi< 25.5.31-r3
- zizmor< 1.12.1-r1
- ztunnel-1.24< 1.24.6-r3
- ztunnel-1.24-compat< 1.24.6-r3
- ztunnel-1.25< 1.25.4-r2
- ztunnel-1.25-compat< 1.25.4-r2
- ztunnel-1.26< 1.26.3-r1
- ztunnel-1.26-compat< 1.26.3-r1
- ztunnel-1.27< 1.27.0-r1
- ztunnel-1.27-compat< 1.27.0-r1
- ztunnel-fips-1.24< 1.24.6-r2
- ztunnel-fips-1.24-compat< 1.24.6-r2
- ztunnel-fips-1.25< 1.25.4-r2
- ztunnel-fips-1.25-compat< 1.25.4-r2
- ztunnel-fips-1.26< 1.26.3-r3
- ztunnel-fips-1.26-compat< 1.26.3-r3
- ztunnel-fips-1.27< 1.27.0-r2
- ztunnel-fips-1.27-compat< 1.27.0-r2
Wolfi76 products
- atuin< 18.8.0-r1
- berg< 0.4.11-r2
- buck2< 20250401-r4
- cargo-audit< 0.21.2-r7
- cargo-audit-doc< 0.21.2-r7
- cargo-c< 0.10.15-r1
- kdash< 0.6.2-r8
- libwasmtime< 36.0.2-r1
- linkerd-extension-init< 0.1.7-r1
- linkerd-network-validator< 0.1.4-r1
- linkerd2< 25.8.5-r1
- linkerd2-cli< 25.8.5-r1
- linkerd2-controller< 25.8.5-r1
- linkerd2-controller-compat< 25.8.5-r1
- linkerd2-debug< 25.8.5-r1
- linkerd2-metrics-api< 25.8.5-r1
- linkerd2-metrics-api-compat< 25.8.5-r1
- linkerd2-policy-controller< 25.8.5-r1
- linkerd2-proxy< 2.316.0-r1
- linkerd2-proxy-identity< 25.8.5-r1
- linkerd2-tap< 25.8.5-r1
- linkerd2-tap-compat< 25.8.5-r1
- linkerd2-web< 25.8.5-r1
- mountpoint-s3< 1.19.0-r2
- mountpoint-s3-compat< 1.19.0-r2
- ntpd-rs< 1.6.2-r1
- oranda< 0.6.5-r10
- parseable< 2.4.2-r1
- pgcat< 1.2.0-r6
- pixi< 0.53.0-r1
- pixi-compat< 0.53.0-r1
- py3-supported-hf-xet< 1.1.9-r1
- py3-supported-uv-build< 0.8.14-r1
- py3-xet-core< 1.1.9-r1
- py3.10-hf-xet< 1.1.9-r1
- py3.10-uv-build< 0.8.14-r1
- py3.10-uv-build-bin< 0.8.14-r1
- py3.11-hf-xet< 1.1.9-r1
- py3.11-uv-build< 0.8.14-r1
- py3.11-uv-build-bin< 0.8.14-r1
- py3.12-hf-xet< 1.1.9-r1
- py3.12-uv-build< 0.8.14-r1
- py3.12-uv-build-bin< 0.8.14-r1
- py3.13-hf-xet< 1.1.9-r1
- py3.13-uv-build< 0.8.14-r1
- py3.13-uv-build-bin< 0.8.14-r1
- qdrant< 1.15.4-r1
- qdrant-oci-compat< 1.15.4-r1
- qdrant-oci-entrypoint< 1.15.4-r1
- ruff< 0.12.11-r1
- ruff-python-formatter< 0.12.11-r1
- rust-analyzer< 20250825-r1
- rustup< 1.28.2-r2
- shadowsocks-rust< 1.23.5-r3
- shadowsocks-rust-sslocal< 1.23.5-r3
- shadowsocks-rust-ssmanager< 1.23.5-r3
- shadowsocks-rust-ssserver< 1.23.5-r3
- shadowsocks-rust-ssservice< 1.23.5-r3
- shadowsocks-rust-ssurl< 1.23.5-r3
- topgrade< 16.0.4-r3
- topgrade-bash-completion< 16.0.4-r3
- topgrade-doc< 16.0.4-r3
- topgrade-fish-completion< 16.0.4-r3
- topgrade-zsh-completion< 16.0.4-r3
- uv< 0.8.14-r1
- wadm< 0.21.0-r4
- wash< 0.39.0-r5
- wasmcloud< 1.9.0-r1
- wasmtime< 36.0.2-r1
- wasmtime-dev< 36.0.2-r1
- yazi< 25.5.31-r3
- zizmor< 1.12.1-r1
- ztunnel-1.26< 1.26.3-r1
- ztunnel-1.26-compat< 1.26.3-r1
- ztunnel-1.27< 1.27.0-r1
- ztunnel-1.27-compat< 1.27.0-r1
2 vendors · 172 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2025-4432chainguardatuin+1211.03%A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially crafted packet. It will likely occur unintentionally in 1 out of every 2**32 packets sent or received.CVE-2025-58160chainguardatuin+1880.34%tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.CVE-2025-24898chainguardberg+460.68%rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument's buffer but with a lifetime bound to the `client` argument. In situations where the `sever` buffer's lifetime is shorter than the `client` buffer's, this can cause a use after free. This could cause the server to crash or to return arbitrary memory contents to the client. The crate`openssl` version 0.10.70 fixes the signature of `ssl::select_next_proto` to properly constrain the output buffer's lifetime to that of both input buffers. Users are advised to upgrade. In standard usage of `ssl::select_next_proto` in the callback passed to `SslContextBuilder::set_alpn_select_callback`, code is only affected if the `server` buffer is constructed *within* the callback.CVE-2020-26235chainguardberg+181.97%In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.CVE-2024-47609chainguardatuin+190.62%Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS attack that can cause the server to exit cleanly on accepting a TCP/TLS stream. This can be triggered by causing the accept call to error out with errors that were not covered correctly causing the accept loop to exit. Upgrading to tonic 0.12.3 and above contains the fix.CVE-2024-43806chainguardbat+270.48%Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using `rustix::fs::Dir` using the `linux_raw` backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in `rustix::fs::Dir::read_more`, this can cause quick and unbounded memory explosion (gigabytes in a few seconds if used on a hot path) and eventually lead to an OOM crash of the application. The symptoms were initially discovered in https://github.com/imsnif/bandwhich/issues/284. That post has lots of details of our investigation. Full details can be read on the GHSA-c827-hfw6-qwvm repo advisory. If a program tries to access a directory with its file descriptor after the file has been unlinked (or any other action that leaves the `Dir` iterator in the stuck state), and the implementation does not break after seeing an error, it can cause a memory explosion. As an example, Linux's various virtual file systems (e.g. `/proc`, `/sys`) can contain directories that spontaneously pop in and out of existence. Attempting to iterate over them using `rustix::fs::Dir` directly or indirectly (e.g. with the `procfs` crate) can trigger this fault condition if the implementation decides to continue on errors. An attacker knowledgeable about the implementation details of a vulnerable target can therefore try to trigger this fault condition via any one or a combination of several available APIs. If successful, the application host will quickly run out of memory, after which the application will likely be terminated by an OOM killer, leading to denial of service. This issue has been addressed in release versions 0.35.15, 0.36.16, 0.37.25, and 0.38.19. Users are advised to upgrade. There are no known workarounds for this issue.