Edit ndaal-sa-2026-037

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

nvulnlookup v0.1.39 introduces an in-memory `VulnStorage::new_in_memory()` constructor (alongside the existing file-backed `VulnStorage::new(path)`) so the test suite can exercise the redb schema without ever touching the filesystem.  Sixteen test files across `crates/vl-core/tests/` and `crates/vl-feeders/src/feeders/*.rs` were migrated from `tempfile::TempDir` + `VulnStorage::new(&db_path)` to the new in-memory backend.  The change has three measurable benefits: (a) `cargo +nightly miri test --package vl-core` now runs clean without `-Zmiri-disable-isolation` (previously failed with `unsupported operation: `mkdir(at)` not available with isolation enabled` inside `tempfile::TempDir::new()` at `crates/vl-core/tests/test_all_feeds.rs:45`); (b) ~1180 test cases that previously did one `mkdir`+`open`+`unlink` per test now do zero filesystem syscalls — the suite is faster and the parallel runner can no longer hit per-process FD limits on macOS; (c) the workspace exercises a publicly-supported redb code path (`redb::Builder::create_with_backend(redb::backends::InMemoryBackend::new())`) that was not previously covered by any test, so a regression in the in-memory backend would now break CI instead of shipping silently.  The file-backed constructor `VulnStorage::new(path)` is unchanged and remains the production path; two FS-specific tests in `test_redb_storage.rs` (`test_31_database_survives_drop_and_reopen`, `test_32_invalid_database_path`) keep their `tempfile::TempDir` setup but are gated on `#[cfg(not(miri))]` so the miri run skips them cleanly.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel