Repository navigation
chore(deps): resolve quinn-proto, rustls, and ruzstd RustSec advisories - #2397
Conversation
quinn-proto 0.11.15 and 0.11.16 let a remote peer bypass the stream reassembly chunk cap with small gapped STREAM frames and pin gigabytes of receiver memory. 0.11.17 fixes it; 0.11.19 is the newest release the 14-day publish-age cooldown allows. quinn is an optional reqwest dependency behind the `http3` feature, which no workspace crate enables, so the crate is never compiled. It still appears in Cargo.lock, where `cargo audit` reports it.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🔒 AI Security Review (claude-opus-5-5)✅ No security issues found. |
rustls 0.23.9 through 0.23.45 let a peer force a 1 GiB allocation through the Brotli certificate decompressor before authentication. 0.23.46 fixes it. Only the non-default `brotli` feature is affected, and no workspace crate enables it, but `cargo audit` flags the locked version. 0.23.46 was published on 2026-10-14, inside the 14-day publish-age cooldown, so this resolve used the documented one-off override `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow`.
storopoli
changed the title
🔒 AI Security Review (claude-opus-5-5)✅ No security issues found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa927bbe37
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ruzstd 0.8.3 has a decompression bomb, fixed in 0.9.1. It comes in only through object 0.37.3, which sp1-core-executor 6.8.1 depends on with default features, enabling object's `compression` feature. No SP1 release, up to 6.9.0, moves to object 0.40, the first version on ruzstd 0.9, so no lockfile update can fix it. No code in the dependency graph decompresses zstd data: sp1-core-executor uses object only to write ELF files, and backtrace leaves its own `ruzstd` feature off. The ignore entry records the reasoning and when to remove it.
storopoli
changed the title
🔒 AI Security Review (claude-opus-5-5)✅ No security issues found. |
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #2397 +/- ##
==========================================
- Coverage 89.11% 89.11% -0.01%
==========================================
Files 441 441
Lines 75737 75737
==========================================
- Hits 67495 67493 -2
- Misses 8242 8244 +2
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Description
Clears every vulnerability
cargo auditcurrently reports, which also fails onmainnow that the new advisories have reached the advisory database:quinn-protorustlsruzstd.cargo/audit.tomlThere is one commit per crate.
quinn-proto. In 0.11.15 and 0.11.16, the cap on buffered stream-reassembly chunks is only checked on the defragmentation path, so a remote peer can bypass it with small gapped STREAM frames and pin roughly 3 GB of receiver memory. Fixed in 0.11.17. The resolver picked 0.11.19, the newest release that passes the 14-day
min-publish-agecooldown.rustls. 0.23.46 fixes four advisories published on 2026-10-14: a 1 GiB allocation through Brotli certificate decompression (0348), a ServerHello downgrade to classical key exchange (0349), buffered data sent to the outer server after ECH rejection (0347), and
Debugimpls exposing TLS secrets (0346).ruzstd. 0.8.3 has a decompression bomb, fixed in 0.9.1. The lockfile cannot pick up that fix.
ruzstdcomes in only throughobject0.37.3, whichsp1-core-executor6.8.1 depends on with default features, turning onobject'scompressionfeature. No SP1 release, up to 6.9.0, moves toobject0.40, the first version on ruzstd 0.9. This PR adds the advisory to the.cargo/audit.tomlignore list, which bothcargo auditruns insecurity.ymlread, with the reasoning and the removal condition next to the entry.The lockfile bumps change only each crate's version and checksum; no dependency lists change.
Type of Change
Notes to Reviewers
Reachability. Two of the three vulnerable paths are not reachable in our builds:
quinnis an optionalreqwestdependency behind thehttp3feature. No workspace crate enables it, andcargo tree -i quinn-proto --all-features -e all --target allfinds no path to it, soquinn-protois never compiled. It is still recorded inCargo.lock, which is whatcargo auditscans.ruzstdis compiled into SP1-feature builds, but no code in the dependency graph decompresses zstd data with it.objecthas two dependents.sp1-core-executoruses it only to write ELF files (src/minimal/debug.rs).backtracereads ELF with its own code, and its zstd path is gated on its ownruzstdfeature, which is off.brotlifeature, whichcargo tree -e featuresshows no crate enabling. I did not check our exposure to the other three rustls advisories; the bump fixes them regardless.Cooldown override for rustls. rustls 0.23.46 was published on 2026-10-14, inside the 14-day cooldown, so its commit used the override documented in
.cargo/config.toml:Why ignore ruzstd instead of patching.
object0.37.3 compiles unchanged against ruzstd 0.9.1, so the alternative was a[patch.crates-io]entry forobject, from analpenlabs/objectfork or a vendored copy (about 52k lines). We chose the ignore entry over maintaining a fork ofobjectfor a code path nothing calls.The SP1 checkpoint guest lockfile (
provers/sp1/guest-checkpoint/Cargo.lock) contains none of these crates.Is this PR addressing any specification, design doc or external reference document?
If yes, please add relevant links:
Checklist
Local checks:
cargo metadata --lockedresolves,cargo check -p rustls -p tokio-rustls -p hyper-rustls --lockedbuilds against rustls 0.23.46, andtaplo fmt --checkpasses on.cargo/audit.toml.cargo audit, unit tests, and functional tests are left to CI.AI assistance: Claude Code ran the
cargo updatecommands, traced the dependency paths and feature sets, wrote theaudit.tomlentry, and drafted this PR description.Related Issues
Fixes RUSTSEC-2026-0341, RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349. Ignores RUSTSEC-2026-0344 until SP1 moves to
object>= 0.40.