Vulnerability RUSTSEC-2026-0449

Unknown

1 day ago

`ocipkg` is unmaintained

>=0.0.0-0

Summary

`ocipkg` is unmaintained

Details

The author of ocipkg has archived the repository and declared the crate no longer maintained. Version 0.4.1 is stated to be the final release. "No further updates, including security fixes, are planned."

Alternatives

For interacting with OCI registries, the maintainer suggests the ORAS project's oci-client.
For ocipkg-specific functionality (local package management, or build-time library fetching and linking), the maintainer suggests forking the repository from 0.4.1 and maintaining it for your use case, as oci-client is not a drop-in replacement for those features.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk

7 days ago

`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)

>=0.0.0-0 <0.4.1 RUSTSEC-2026-0450

View all vulnerabilities for these packages

Impacted packages

ocipkg

Timeline

Published

1 day ago

Last Modified

5 hours ago