feat(security): Audit and remediate known CVEs / RustSec advisories in the dependency tree

[ryerraguntla]

Description

Type: security
Labels: security, dependencies, C-tracking
Source: discussion #3678

Summary

An initial cargo audit scan of Cargo.lock (Jul 18, 2026) surfaced known
vulnerabilities, unmaintained crates, and one unsound/yanked crate across the
transitive dependency graph. This issue tracks triage and remediation of each
advisory: upgrade where a fix exists, replace/remove unmaintained crates where
feasible, and record an accepted-risk ignore entry (with justification) where no
fix is available.

Affected area / component

Connectors

Proposed solution

Motivation

CVE management is a baseline requirement for enterprise-grade software (see the
Log4j fallout referenced in #3678). Iggy ships production binaries and multiple
SDKs; unpatched advisories in the dependency graph are shipped to every operator.
Remediating now, plus wiring the automated gate in the sibling issues, prevents
regressions.

References: https://rustsec.org/, https://rustsec.org/advisories/,
https://github.com/advisories, https://osv.dev/

Advisories from initial scan

Vulnerabilities (fix available)

Crate	Version	Advisory	Severity	Fix
crossbeam-epoch	0.9.18	RUSTSEC-2026-0204 — invalid pointer deref in fmt::Pointer for Atomic/Shared	-	upgrade >=0.9.20
quick-xml	0.37.5	RUSTSEC-2026-0195 — unbounded namespace-declaration alloc (memory-exhaustion DoS)	7.5 high	upgrade >=0.41.0
quick-xml	0.37.5	RUSTSEC-2026-0194 — quadratic run time on duplicate attribute-name check	7.5 high	upgrade >=0.41.0
quick-xml	0.38.4	RUSTSEC-2026-0195	7.5 high	upgrade >=0.41.0
quick-xml	0.38.4	RUSTSEC-2026-0194	7.5 high	upgrade >=0.41.0
quick-xml	0.39.4	RUSTSEC-2026-0195	7.5 high	upgrade >=0.41.0
quick-xml	0.39.4	RUSTSEC-2026-0194	7.5 high	upgrade >=0.41.0

Multiple quick-xml versions present (0.37.5 / 0.38.4 / 0.39.4) indicate
duplicate versions pulled by different dependents. Consolidate to a single
>=0.41.0 where possible.

Vulnerabilities (no fix available — accept-risk with justification)

Crate	Version	Advisory	Severity	Note
rsa	0.9.10	RUSTSEC-2023-0071 — Marvin Attack, key recovery via timing sidechannel	5.9 medium	no fixed upgrade available; document exposure + ignore entry

Unmaintained / unsound / yanked warnings

Crate	Version	Advisory	Class
atomic-polyfill	1.0.3	RUSTSEC-2023-0089	unmaintained
bincode	1.3.3	RUSTSEC-2025-0141	unmaintained
paste	1.0.15	RUSTSEC-2024-0436	unmaintained
proc-macro-error	1.0.4	RUSTSEC-2024-0370	unmaintained
proc-macro-error2	2.0.1	RUSTSEC-2026-0173	unmaintained
rustls-pemfile	2.2.0	RUSTSEC-2025-0134	unmaintained
rustybuzz	0.20.1	RUSTSEC-2026-0206	unmaintained
ttf-parser	0.25.1	RUSTSEC-2026-0192	unmaintained
anyhow	1.0.102	RUSTSEC-2026-0190 — unsoundness in Error::downcast_mut()	unsound
spin	0.9.8	(yanked)	yanked

Scope / tasks

• Reproduce the scan: cargo audit on current Cargo.lock, attach fresh output.
• Upgrade crossbeam-epoch to >=0.9.20.
• Consolidate + upgrade quick-xml to >=0.41.0; remove duplicate versions.
• Upgrade anyhow past the unsound downcast_mut() (patched release).
• Replace spin yanked pin with a valid release.
• For each unmaintained crate: identify the dependent, upgrade the dependent to drop it, or record a justified accept.
• For rsa (no fix): document exposure (is timing sidechannel reachable in Iggy's threat model?) and add an [advisories] ignore entry with a comment + review date.
• Land any accepted-risk exceptions in deny.toml (coordinate with the cargo-deny gate issue).

Acceptance criteria

• cargo audit passes, or every remaining finding has a documented, justified ignore entry with an owner and review date.
• No duplicate quick-xml versions remain in Cargo.lock (or duplication is justified).
• Fresh scan output attached to the issue showing before/after.

Related

• Enable cargo deny in pre-merge checks (sibling issue).
• Make production binaries auditable via cargo auditable (sibling issue).

Alternatives considered

No response

Contribution

• I'm willing to submit a pull request to implement this feature

Good first issue

• I think this could be a good first issue for a new contributor

[ryerraguntla]

Initial Analysis -

CVE scope + risk summary

Reverse-dependency scan of Cargo.lock. Consumers below are workspace crates (deduped, -e normal unless noted). "Edge" = whether crate is a runtime dep or build-time only (proc-macro / build-script) — build-only advisories carry no runtime attack surface.

Fix-available vulnerabilities

Crate	Ver	Edge	Advisory	Reachable via	Scope	Fix
crossbeam-epoch	0.9.18	runtime	RUSTSEC-2026-0204 (invalid ptr deref in fmt::Pointer)	broad: server, shard, journal, metadata, consensus, connectors, bench	wide but bug only triggers on {:?}-formatting an invalid Atomic/Shared — not on normal use	bump >=0.9.20 (clean, transitive)
quick-xml	0.37.5	runtime	RUSTSEC-2026-0194/0195 (XML DoS)	iceberg_sink (reqsign)	3 sinks only	blocked — upstreams pin <0.41 (see quick-xml note)
quick-xml	0.38.4	runtime	RUSTSEC-2026-0194/0195	iceberg_sink (opendal), s3_sink + integration (rust-s3/aws-creds)	3 sinks only	blocked
quick-xml	0.39.4	runtime	RUSTSEC-2026-0194/0195	delta_sink + integration (object_store/deltalake)	2 crates	blocked

No-fix vulnerability (accept-risk)

Crate	Ver	Edge	Advisory	Reachable via	Scope	Note
rsa	0.9.10	runtime	RUSTSEC-2023-0071 (Marvin timing sidechannel, 5.9)	server, connectors, consensus, sqlx-mysql etc.	wide	no upstream fix; reachable only for RSA private-key ops (mostly MySQL/TLS handshake). Document + ignore

Unmaintained / unsound / yanked (warnings, not vulns)

Crate	Ver	Edge	Advisory	Consumers	Action
anyhow	1.0.102	runtime	RUSTSEC-2026-0190 (unsound downcast_mut())	nearly all crates	bump to patched 1.0.x (clean, high value)
spin	0.9.8	runtime	yanked	nearly all crates	bump/dedupe to valid release
bincode	1.3.3	runtime	RUSTSEC-2025-0141 (unmaintained)	bench + dashboard only	low; scope = bench tooling
paste	1.0.15	build (proc-macro)	RUSTSEC-2024-0436 (unmaintained)	nearly all crates	build-time only; no runtime surface. Track/replace
proc-macro-error	1.0.4	build	RUSTSEC-2024-0370 (unmaintained)	server, connectors, consensus, etc.	build-time only; drop via dependent bump
proc-macro-error2	2.0.1	build	RUSTSEC-2026-0173 (unmaintained)	delta_sink, integration	build-time only
rustls-pemfile	2.2.0	runtime	RUSTSEC-2025-0134 (unmaintained)	server, consensus, integration, TLS stack	bump/replace via rustls dependent
rustybuzz	0.20.1	runtime	RUSTSEC-2026-0206 (unmaintained)	bench + dashboard only (plotting/font)	low; scope = bench tooling
ttf-parser	0.25.1	runtime	RUSTSEC-2026-0192 (unmaintained)	bench + dashboard only	low; scope = bench tooling
atomic-polyfill	1.0.3	-	RUSTSEC-2023-0089	not found in current lock	likely already dropped; verify + remove from list

Remediation ordering (low-risk first)

1. crossbeam-epoch >=0.9.20 — clean transitive bump, no API break expected.
2. anyhow patched 1.0.x — clean, removes unsound advisory, huge blast radius so high value.
3. spin — dedupe/bump off yanked pin.
4. bench-only cluster (bincode, rustybuzz, ttf-parser) — isolated to bench/dashboard; safe to defer or bump independently.
5. build-only proc-macro cluster (paste, proc-macro-error, proc-macro-error2) — no runtime surface; resolve via dependent bumps, low urgency.
6. rustls-pemfile — via rustls stack bump.
7. rsa — accept-risk ignore + document (no fix).
8. quick-xml — accept-risk ignore + upstream tracking (blocked; see below).

quick-xml blocker (detail)

All three minors are transitively pinned by leaf crates already at latest
published version:

• iceberg-storage-opendal 0.9.1 → reqsign ^0.16.3 (quick-xml 0.37) + opendal ^0.55 (quick-xml 0.38)
• rust-s3 0.37.2 / aws-creds 0.39.1 → quick-xml ^0.38
• deltalake 0.32.4 → object_store 0.13 → quick-xml ^0.39

object_store 0.14.1 already uses quick-xml ^0.41, but deltalake 0.32.4 (latest) pins object_store 0.13. No bump path exists today. Reachable only when s3/iceberg/delta sinks parse XML from the operator-configured storage backend, not from Iggy message payloads. Recommend accept-risk ignore with review-by date; close out when deltalake/rust-s3/iceberg adopt object_store 0.14 / quick-xml 0.41.