crates.io/rkyv: unknown
Crafted archives can cause a use-after-free during deserialization
Action: Upgrade rkyv to 0.8.17 or later.
cargo update -p rkyv --precise 0.8.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.8.0-rc.1 | 0.8.17 | - |
Fixed versions
| 0.8.17 |
Sources
- osv: RUSTSEC-2026-0233
- https://crates.io/crates/rkyv
- https://rustsec.org/advisories/RUSTSEC-2026-0233.html
- https://github.com/rkyv/rkyv/issues/666
- https://github.com/rkyv/rkyv/commit/3c9d07fbff5949261bef38d00ab160b129bd9d3a
- https://github.com/rkyv/rkyv/commit/107772907c4e839fa67900385f0d4814e7d15e42
published · modified · JSON