{"action":"Upgrade dynoxide-rs to 0.9.13 or later.","affected":[{"fixed":"0.9.13","introduced":"0.9.3"}],"component":"dynoxide-rs","cve_ids":["CVE-2026-42559"],"ecosystem":"crates.io","epss":0.00269,"exploited":false,"fixed_versions":["0.9.13"],"ghsa_id":"GHSA-89vp-x53w-74fx","id":"tcs_01M5KFBFGCEYHQ9K35P01YFE06","modified_at":"2026-10-12T18:00:08.330166697Z","published_at":"2026-05-12T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0140","https://crates.io/crates/dynoxide-rs","https://rustsec.org/advisories/RUSTSEC-2026-0140.html","https://github.com/nubo-db/dynoxide/commit/10292083fd16fe7116e9089ffa189f4f4f071e0f","https://github.com/nubo-db/dynoxide/releases/tag/v0.9.13"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0140","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0140"}],"summary":"DNS rebinding and cross-origin CSRF in dynoxide's MCP HTTP transport"}