{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_vex","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"Seven RUSTSEC advisories surfaced by `cargo audit` and `cargo deny check` against the v0.1.37 workspace are reported as transitive findings via the `rprobe = 0.9` `[dev-dependencies]` of `vl-web`.  All seven are `not_affected` for shipped nvulnlookup binaries because rprobe is a test-only dependency and never linked into the production artefacts.  This advisory documents the disposition + reachability analysis for each finding so downstream auditors can verify the call graph independently.","title":"Summary"},{"category":"description","text":"rprobe 0.9 is the latest version published to crates.io and pulls a frozen `sled 0.34` / `parking_lot 0.11` / `rustls 0.21` stack whose deeper dependencies have outstanding RUSTSEC entries.  rprobe is consumed in EXACTLY ONE place in our tree: `crates/vl-web/tests/test_rprobe_smoke.rs`, an `#[ignore]`-marked integration test that calls `rprobe::tls_analyzer::TlsAnalyzer::analyze(...)` against a live `vl-web` instance to confirm TLS 1.3 negotiation.  The dependency is declared in `[dev-dependencies]` (see `crates/vl-web/Cargo.toml:88`), so cargo never links it into the release binary.  Operationally the TLS 1.3 mandate (CLAUDE.md §Encryption Data-in-Transit) is enforced by gate 9b (`test/testssl/run.sh`), which runs against the live binary with the standalone `testssl.sh` toolchain — that is the path a real auditor walks, not the rprobe smoke test.\n\nFindings covered by this VEX bundle (all sharing the `rprobe 0.9 → ...` dep-tree root):\n\n  - RUSTSEC-2024-0384  `instant` unmaintained\n      via parking_lot_core 0.8.6 → parking_lot 0.11.2 → sled 0.34.7 → rprobe 0.9.0\n  - RUSTSEC-2025-0057  `fxhash` unmaintained\n      via rprobe 0.9.0 transitive\n  - RUSTSEC-2025-0119  `number_prefix` unmaintained\n      via indicatif 0.17.11 → rprobe 0.9.0\n  - RUSTSEC-2025-0141  `bincode` 1.x unmaintained\n      via rprobe 0.9.0 transitive\n  - RUSTSEC-2026-0098  `rustls-webpki` 0.101 — name constraints for URI names incorrectly accepted\n      via rustls 0.21.12 → rprobe 0.9.0\n  - RUSTSEC-2026-0099  `rustls-webpki` 0.101 — wildcard name-constraint bypass (alias GHSA-xgp8-3hg3-c2mh)\n      via rustls 0.21.12 → rprobe 0.9.0\n  - RUSTSEC-2026-0104  `rustls-webpki` 0.101 — reachable panic in CRL parsing\n      via rustls 0.21.12 → rprobe 0.9.0","title":"Description"},{"category":"details","text":"Reachability analysis (per finding):\n\n  - All `unmaintained` advisories (instant / fxhash / number_prefix / bincode) are *informational* RUSTSEC entries; they describe stagnant upstream maintenance, not exploitable bugs.  The crates ship in our test build only and are not invoked outside an `#[ignore]`d test.\n\n  - The two name-constraint bypasses (RUSTSEC-2026-0098 / -0099) require a misissued certificate that asserts a wildcard or URI name explicitly forbidden by a permitted-subtree constraint.  Our smoke test only ever calls `TlsAnalyzer::analyze` against a known-good local nvulnlookup instance with a freshly-generated rcgen self-signed cert — there is no path to a misissued cert in the test fixture.\n\n  - The CRL parse panic (RUSTSEC-2026-0104) is reachable only when an application calls `BorrowedCertRevocationList::from_der` or `OwnedCertRevocationList::from_der`.  rprobe's TLS analyser does not parse CRLs, and our test uses a freshly minted ephemeral cert with no CRL distribution point.\n\nProduction-binary impact:\n\n  - rprobe is `[dev-dependencies]`-only.  `cargo build --release -p vl-web` does NOT link rprobe, sled, or rustls 0.21.  The release artefact's `cargo-auditable` `.dep-v0` SBOM (verified per release with `rust-audit-info`) confirms zero rprobe / sled / rustls 0.21 entries.\n\n  - The `cargo-auditable` SBOM is also the target of the binary-scan gate (`8b. trivy + syft + osv-scanner`); those scanners do NOT report any of the seven findings against the release binary because the offending crates are absent from the linked dep tree.\n\nDisposition: NOT AFFECTED for every shipped nvulnlookup version.  The seven RUSTSEC IDs are listed in `vulnerability-lookup-rs/audit.toml` and `vulnerability-lookup-rs/deny.toml` `ignore = [...]` arrays with the same justification as this VEX advisory; the canonical source of truth is this document.","title":"Reachability + Disposition"},{"category":"general","text":"Recommended action for downstream consumers:\n\n  1. Run `cargo build --release` (NOT `cargo build --tests`) for production deployments.  The release binary has zero exposure to the seven findings.\n\n  2. If you re-run `cargo test` in your environment, the `test_rprobe_smoke` test is `#[ignore]`d by default.  It only runs under `cargo test -- --ignored`.  Treat opt-in execution as a development-time choice, not a deployment posture.\n\n  3. When rprobe upstream cuts a release on rustls 0.23+ (and dependency-pinned bincode 2.x / lru 0.13+ / etc.), drop the seven RUSTSEC entries from `audit.toml` / `deny.toml` and supersede this advisory with a final-status revision.\n\n  4. The TLS 1.3 mandate continues to be enforced by `testssl.sh` (gate 9b) and the per-listener TLS conformance test under `test/testssl/run.sh`.  Operators do NOT need rprobe to verify TLS posture.\n\nNo workaround is required for already-deployed binaries.  No CVE has been assigned to any of the seven findings against nvulnlookup because none is reachable from the shipped product.","title":"Recommended action"},{"category":"other","text":"Disposition: VEX `not_affected` for every nvulnlookup version 0.1.30 and later.  The seven findings sit on a frozen test-only branch of the dep tree.  This advisory will be revised to status `final` once rprobe upstream publishes a release on the modern rustls / bincode / lru stack.","title":"Disposition"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/033/ndaal-sa-2026-033.json"},{"category":"external","summary":"RUSTSEC-2024-0384 — instant unmaintained","url":"https://rustsec.org/advisories/RUSTSEC-2024-0384"},{"category":"external","summary":"RUSTSEC-2025-0057 — fxhash unmaintained","url":"https://rustsec.org/advisories/RUSTSEC-2025-0057"},{"category":"external","summary":"RUSTSEC-2025-0119 — number_prefix unmaintained","url":"https://rustsec.org/advisories/RUSTSEC-2025-0119"},{"category":"external","summary":"RUSTSEC-2025-0141 — bincode unmaintained","url":"https://rustsec.org/advisories/RUSTSEC-2025-0141"},{"category":"external","summary":"RUSTSEC-2026-0098 — rustls-webpki URI name-constraint bypass","url":"https://rustsec.org/advisories/RUSTSEC-2026-0098"},{"category":"external","summary":"RUSTSEC-2026-0099 — rustls-webpki wildcard name-constraint bypass","url":"https://rustsec.org/advisories/RUSTSEC-2026-0099"},{"category":"external","summary":"RUSTSEC-2026-0104 — rustls-webpki CRL panic","url":"https://rustsec.org/advisories/RUSTSEC-2026-0104"},{"category":"external","summary":"rprobe on crates.io","url":"https://crates.io/crates/rprobe"}],"title":"ndaal VEX Advisory: 7 rprobe-transitive RUSTSEC findings — not_affected (test-only dev-dependency)","tracking":{"current_release_date":"2026-04-25T21:03:36.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-033","initial_release_date":"2026-04-25T21:03:36.000Z","revision_history":[{"date":"2026-04-25T21:03:36.000Z","number":"1.0.0","summary":"Initial VEX advisory bundling the seven rprobe-transitive RUSTSEC findings (RUSTSEC-2024-0384, -2025-0057, -2025-0119, -2025-0141, -2026-0098, -2026-0099, -2026-0104) and recording disposition `not_affected` for every shipped nvulnlookup version.  Mirrored in `vulnerability-lookup-rs/audit.toml` and `deny.toml` `ignore = [...]` arrays with the same per-entry justification.  Status: interim until rprobe upstream cuts a release on rustls 0.23+."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"nvulnlookup","branches":[{"category":"product_version_range","name":">=0.1.30,<=0.1.37","product":{"name":"nvulnlookup 0.1.30 .. 0.1.37 — test-only rprobe dev-dep, no release-binary linkage to affected crates","product_id":"CSAFPID-0001"}}]}]}]},"vulnerabilities":[{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2024-0384"}],"notes":[{"category":"description","text":"instant — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2024-0384","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `parking_lot_core 0.8.6 → parking_lot 0.11.2 → sled 0.34.7 → rprobe 0.9.0 → (dev) vl-web`.  Test-only dependency; not present in the release binary."}],"title":"instant — crate unmaintained","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2025-0057"}],"notes":[{"category":"description","text":"fxhash — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2025-0057","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `rprobe 0.9.0 → (dev) vl-web`.  Test-only dependency."}],"title":"fxhash — crate unmaintained","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2025-0119"}],"notes":[{"category":"description","text":"number_prefix — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2025-0119","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `indicatif 0.17.11 → rprobe 0.9.0 → (dev) vl-web`.  Test-only dependency."}],"title":"number_prefix — crate unmaintained","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2025-0141"}],"notes":[{"category":"description","text":"bincode 1.x — crate unmaintained. Identifiers: RustSec Advisory Database:RUSTSEC-2025-0141","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `rprobe 0.9.0 → (dev) vl-web`.  Test-only dependency."}],"title":"bincode 1.x — crate unmaintained","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2026-0098"}],"notes":[{"category":"description","text":"rustls-webpki — name constraints for URI names were incorrectly accepted. Identifiers: RustSec Advisory Database:RUSTSEC-2026-0098","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `rustls 0.21.12 → rprobe 0.9.0 → (dev) vl-web`.  Reachability requires a misissued cert with a URI-name component the smoke test never sees; the local nvulnlookup target uses a freshly generated rcgen self-signed cert."}],"title":"rustls-webpki — name constraints for URI names were incorrectly accepted","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2026-0099"}],"notes":[{"category":"description","text":"rustls-webpki — wildcard-name-constraint bypass (alias GHSA-xgp8-3hg3-c2mh). Identifiers: RustSec Advisory Database:RUSTSEC-2026-0099","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `rustls 0.21.12 → rprobe 0.9.0 → (dev) vl-web`.  Reachability requires a misissued cert; not encountered in the smoke-test fixture."}],"title":"rustls-webpki — wildcard-name-constraint bypass (alias GHSA-xgp8-3hg3-c2mh)","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2026-0104"}],"notes":[{"category":"description","text":"rustls-webpki — reachable panic in CRL parsing. Identifiers: RustSec Advisory Database:RUSTSEC-2026-0104","title":"Description"}],"product_status":{"known_not_affected":["CSAFPID-0001"]},"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":0.0,"baseSeverity":"NONE","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Reached only through `rustls 0.21.12 → rprobe 0.9.0 → (dev) vl-web`.  Reachability requires the application to parse a CRL; the smoke test does not parse CRLs (no CRL distribution point on the ephemeral self-signed cert)."}],"title":"rustls-webpki — reachable panic in CRL parsing","flags":[{"label":"vulnerable_code_not_present","product_ids":["CSAFPID-0001"]}]}]}