RUSTSEC-2025-0051: `xcb::Connection::connect_to_fd*` functions violate I/O safety

What to do

1. See which version you have: cargo tree -i xcb (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p xcb. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example xcb = "1.6.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd (such as a UnixStream) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety.

Starting in version 1.6.0, xcb provides Connection::connect_with_fd and Connection::connect_with_fd_and_extensions as safe alternatives and deprecates the problematic functions.

References

• Package: crates.io/crates/xcb
• Advisory: rustsec.org/advisories/RUSTSEC-2025-0051.html
• Report: github.com/rust-x-bindings/rust-xcb/issues/282
• Report: github.com/rust-x-bindings/rust-xcb/issues/167
• Web: github.com/rust-x-bindings/rust-xcb/pull/283

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for xcb

• Unsound MediumRUSTSEC-2020-0097 · 2020-12-10Soundness issue with base::Error
• VulnerabilityRUSTSEC-2021-0019 · 2021-02-04Multiple soundness issues

Full security history of xcb