Repository navigation

Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Security updates are provided for the following versions:

Version	Supported
5.y.z	✅
< 5.0	❌

Reporting a Vulnerability

Please report any vulnerabilities by using GitHub's Private Vulnerability Reporting.

If you've been unable to find a way to report it, or have received no response after repeated attempts, please email security@gobysoft.org.

Weak passphrase KDF (unsalted SHA-256) and weak apt key verification in the install docs
GHSA-hw4m-j9m4-fpwh published Oct 23, 2026 by tsaubergine

Low
v3/v4 DefaultMessageCodec places embedded messages with a non-default codec in the unencrypted header
GHSA-2gmm-48vf-2c7x published Oct 23, 2026 by tsaubergine

Moderate
native_protobuf decoder ignores ReadPrimitive failure and returns uninitialized values for malformed fields
GHSA-9867-2j55-xgcx published Oct 23, 2026 by tsaubergine

Low
native_protobuf enum codec accepts negative indices from the wire, leading to an out-of-bounds read and crash
GHSA-3p5c-jmw7-rv5x published Oct 23, 2026 by tsaubergine

Moderate
Codec::decode reads past the end of input shorter than the message's header size
GHSA-m9rv-w8x4-9q6p published Oct 23, 2026 by tsaubergine

Moderate
Encrypted message bodies use unauthenticated AES-CTR, so ciphertext can be modified or replayed undetected
GHSA-5mrm-2hj8-x38x published Oct 23, 2026 by tsaubergine

Moderate
AES-CTR IV is derived only from the cleartext header, so the keystream repeats across messages
GHSA-2qpm-pqpr-jr8g published Oct 23, 2026 by tsaubergine

Moderate

Learn more about advisories related to GobySoft/dccl in the GitHub Advisory Database