AIKIDO-2025-10324
surf is vulnerable to Use of Unmaintained Third Party Components
60
Medium Risk
This Affects:
surfTL;DR
The surf crate is no longer maintained, as indicated by the developer. Its last release dates back to 2021—over three years ago—making it outdated. It relies on the deprecated async-std runtime and an obsolete version of rustls for TLS support, both of which introduce risks related to security, performance, and compatibility with modern Rust tooling. Use of this crate is discouraged in favor of actively maintained alternatives.
Who does this affect?
You are affected if you are using this package.
Background info
surf is vulnerable to Use of Unmaintained Third Party Components in all versions.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant