cert-checker 1.4.1 has been released as a Snap to address a vulnerable dependency. The problem lies in the slab crate. Here's the audit report:
Crate: slab
Version: 0.4.10
Title: Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Date: 2025-08-12
ID: RUSTSEC-2025-0047
URL: https://rustsec.org/advisories/RUSTSEC-2025-0047
Solution: Upgrade to >=0.4.11
Dependency tree:
slab 0.4.10
├── tokio 1.47.0
│ ├── tokio-util 0.7.15
│ │ └── h2 0.3.27
│ │ ├── reqwest 0.11.27
│ │ │ └── certchecker 1.4.0
│ │ └── hyper 0.14.32
│ │ ├── reqwest 0.11.27
│ │ └── hyper-tls 0.5.0
│ │ └── reqwest 0.11.27
│ ├── tokio-native-tls 0.3.1
│ │ ├── reqwest 0.11.27
│ │ └── hyper-tls 0.5.0
│ ├── reqwest 0.11.27
│ ├── hyper-tls 0.5.0
│ ├── hyper 0.14.32
│ └── h2 0.3.27
├── h2 0.3.27
├── futures-util 0.3.31
│ ├── reqwest 0.11.27
│ ├── hyper 0.14.32
│ └── h2 0.3.27
├── async-signal 0.2.12
│ └── async-process 2.4.0
│ └── zbus 5.9.0
│ └── notify-rust 4.11.7
│ └── certchecker 1.4.0
├── async-io 2.5.0
│ ├── zbus 5.9.0
│ ├── async-signal 0.2.12
│ └── async-process 2.4.0
└── async-executor 1.13.2
└── zbus 5.9.0
Crate: slab
Version: 0.4.10
Warning: yanked
error: 1 vulnerability found!
warning: 1 allowed warning found
Signatures
- The
cert-checker_1.4.1_amd64.snap
signature can be found here. - The
cert-checker_1.4.1_arm64.snap
signature can be found here.
Pseudo-SBOM
The lockfile can be found here.