AIKIDO-2025-10905
rustls-pemfile is vulnerable to Use of Unmaintained Third Party Components
50
Medium Risk
This Affects:
rustls-pemfileTL;DR
The rustls-pemfile crate is no longer maintained and has been archived since August 2025. The maintainer recommends using the built-in PEM parsing functionality provided directly by rustls-pki-types (available since version 1.9.0). Because the latest rustls-pemfile release is already just a thin wrapper around the same parsing code, migrating to rustls-pki-types should be straightforward.
Who does this affect?
You are affected if you are using this package.
Background info
rustls-pemfile is vulnerable to Use of Unmaintained Third Party Components in all versions.
How to fix this
Remove any rustls-pemfile package from your application. Please take a look at the PemObject trait, which provides methods for reading a single or multiple PEM objects from a file or byte slice.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant