RUSTSEC-2026-0449
`ocipkg` is unmaintained
No score
The author of ocipkg has archived the repository and declared the crate no longer maintained.
Version 0.4.1 is stated to be the final release.
"No further updates, including security fixes, are planned."
Alternatives
- For interacting with OCI registries, the maintainer suggests the ORAS project's
oci-client. - For ocipkg-specific functionality (local package management, or build-time library fetching and
linking), the maintainer suggests forking the repository from
0.4.1 and maintaining it for your use case, as
oci-clientis not a drop-in replacement for those features.
What each source reports
OSV No score
`ocipkg` is unmaintained
The author of ocipkg has archived the repository and declared the crate no longer maintained.
Version 0.4.1 is stated to be the final release.
"No further updates, including security fixes, are planned."
Alternatives
- For interacting with OCI registries, the maintainer suggests the ORAS project's
oci-client. - For ocipkg-specific functionality (local package management, or build-time library fetching and
linking), the maintainer suggests forking the repository from
0.4.1 and maintaining it for your use case, as
oci-clientis not a drop-in replacement for those features.
- Record
RUSTSEC-2026-0449- Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ocipkgcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2026-0449 is a vulnerability with no CVSS score yet in ocipkg, published November 5, 2026. No source lists public exploit code. No source names a fixed version.