VEXquickwit
quickwit
4 statements, issued .Each one is a scanner finding that is not exploitable in this image, and why.
@id https://quench-works.com/vex/quickwit/2026-10-13
GHSA-82j2-j2ch-gfr8
not affected · vulnerable code not in execute path- rustls-webpki 0.101.7
The CRL BIT STRING panic needs CRL parsing with RevocationOptions in a rustls 0.21 verifier. rustls-webpki 0.101.7 is linked only through rustls 0.21.12 <- hyper-rustls 0.24.2 <- aws-smithy-http-client 1.2.0 (hyper-0.14 legacy client), measured with `cargo tree -e features -i [email protected]` on quickwit v0.9.1 with this recipe's feature set. aws-smithy-runtime 1.12.0 builds that legacy client only in src/client/defaults.rs:85 (compiled out when default-https-client is on, which aws-config enables here) and :100 (only for a BehaviorVersion older than v2026_01_12). quickwit-aws/src/lib.rs:58-72 loads the one SdkConfig with BehaviorVersion::v2026_01_12() and an explicit http_client built with tls::Provider::Rustls(CryptoMode::AwsLc), the rustls 0.23 stack; grep over every src/*.rs found no older BehaviorVersion and no hyper_014. The recipe fails the build if either changes. No rustls 0.21 verifier is ever constructed, so certificate path validation and CRL parsing in webpki 0.101.7 never run. The 0.101.x line has no fixed release (fix is 0.103.13). Verified 2026-10-13.
GHSA-965h-392x-2mh5
not affected · vulnerable code not in execute path- rustls-webpki 0.101.7
The URI name constraint bug needs certificate path validation by a rustls 0.21 verifier. rustls-webpki 0.101.7 is linked only through rustls 0.21.12 <- hyper-rustls 0.24.2 <- aws-smithy-http-client 1.2.0 (hyper-0.14 legacy client), measured with `cargo tree -e features -i [email protected]` on quickwit v0.9.1 with this recipe's feature set. aws-smithy-runtime 1.12.0 builds that legacy client only in src/client/defaults.rs:85 (compiled out when default-https-client is on, which aws-config enables here) and :100 (only for a BehaviorVersion older than v2026_01_12). quickwit-aws/src/lib.rs:58-72 loads the one SdkConfig with BehaviorVersion::v2026_01_12() and an explicit http_client built with tls::Provider::Rustls(CryptoMode::AwsLc), the rustls 0.23 stack; grep over every src/*.rs found no older BehaviorVersion and no hyper_014. The recipe fails the build if either changes. No rustls 0.21 verifier is ever constructed, so certificate path validation and CRL parsing in webpki 0.101.7 never run. The 0.101.x line has no fixed release (fix is 0.103.13). Verified 2026-10-13.
GHSA-xgp8-3hg3-c2mh
not affected · vulnerable code not in execute path- rustls-webpki 0.101.7
The wildcard name constraint bug needs certificate path validation by a rustls 0.21 verifier. rustls-webpki 0.101.7 is linked only through rustls 0.21.12 <- hyper-rustls 0.24.2 <- aws-smithy-http-client 1.2.0 (hyper-0.14 legacy client), measured with `cargo tree -e features -i [email protected]` on quickwit v0.9.1 with this recipe's feature set. aws-smithy-runtime 1.12.0 builds that legacy client only in src/client/defaults.rs:85 (compiled out when default-https-client is on, which aws-config enables here) and :100 (only for a BehaviorVersion older than v2026_01_12). quickwit-aws/src/lib.rs:58-72 loads the one SdkConfig with BehaviorVersion::v2026_01_12() and an explicit http_client built with tls::Provider::Rustls(CryptoMode::AwsLc), the rustls 0.23 stack; grep over every src/*.rs found no older BehaviorVersion and no hyper_014. The recipe fails the build if either changes. No rustls 0.21 verifier is ever constructed, so certificate path validation and CRL parsing in webpki 0.101.7 never run. The 0.101.x line has no fixed release (fix is 0.103.13). Verified 2026-10-13.
GHSA-cq8v-f236-94qc
not affected · vulnerable code not present- rand 0.7.3
GHSA-cq8v-f236-94qc makes rand unsound only when its log feature is enabled and a custom logger calls thread_rng. rand 0.7.3 enters through http-types 2.12.0 <- azure_core 0.21.0 (quickwit-storage azure). `cargo tree -e features -i [email protected]` on quickwit v0.9.1 with this recipe's feature set shows only the alloc, std and default features; log is absent, so the logging code in rand 0.7.3 (cfg feature log) is not compiled. The 0.7 line has no fixed release. The recipe runs the same cargo tree check and fails the build if the log feature ever appears. Verified 2026-10-13.