{"action":"Upgrade xxhash-rust to 0.8.16 or later.","affected":[{"fixed":"0.8.16","introduced":"0"}],"component":"xxhash-rust","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.8.16"],"ghsa_id":"GHSA-6g2r-675j-hx59","id":"tcs_01M5KETNBGKHQFAQ5ZZX6VEAZ5","modified_at":"2026-10-02T18:45:04.881140605Z","published_at":"2026-10-02T18:29:13Z","references":["https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59","https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59","https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200","https://github.com/DoumanAsh/xxhash-rust"],"severity":{"label":"low","score":2.3},"sources":[{"source":"osv","source_id":"GHSA-6g2r-675j-hx59","url":"https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59"}],"summary":"xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release"}