Rust advisories / steamworks
Vulnerability MediumRUSTSEC-2026-0121 · steamworks
RUSTSEC-2026-0121: Denial of service in Steamworks game clients/servers using P2P authentication
Short answerA security vulnerability in the steamworks crate: Denial of service in Steamworks game clients/servers using P2P authentication. GitHub rates it Medium. Fixed in 0.13.1: update to a fixed version.
| Crate | steamworks |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.13.1. |
| Fixed in | 0.13.1 |
| Severity | Medium (GitHub rating) |
| Published | 2026-05-05 |
| Last changed | 2026-05-12 |
| Also known as | GHSA-g588-cjg3-6g78 |
| Affected functions | steamworks::Client::process_callbacks, steamworks::Client::register_callback, steamworks::Server::begin_authentication_session, steamworks::User::begin_authentication_session, steamworks::ValidateAuthTicketResponse::from_raw |
What to do
- See which version you have:
cargo tree -i steamworks(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p steamworks. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplesteamworks = "0.13.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Processing the raw ValidateAuthTicketResponse_t callback data panics when the m_eAuthSessionResponse field is k_EAuthSessionResponseAuthTicketNetworkIdentityFailure. This can lead to denial of service in game clients and servers using the begin_authentication_session API to authenticate players if a malicious game client sends an authentication ticket with a network identity that does not match that of the verifier.
References
- Package: crates.io/crates/steamworks
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0121.html
- Report: github.com/Noxime/steamworks-rs/issues/321
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?