{"action":"Upgrade rkyv to 0.8.16 or later.","affected":[{"fixed":"0.8.16","introduced":"0.8.0"}],"component":"rkyv","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.8.16"],"ghsa_id":"GHSA-vfvv-c25p-m7mm","id":"tcs_01M5KF3HVGKQ704X5HFVW0KVW0","modified_at":"2026-09-10T03:50:47.714144241Z","published_at":"2026-05-15T18:09:10Z","references":["https://osv.dev/vulnerability/GHSA-vfvv-c25p-m7mm","https://github.com/rkyv/rkyv/commit/5828cf5c27b664eb4432c4a93d4769e12e5e42fb","https://github.com/rkyv/rkyv","https://rustsec.org/advisories/RUSTSEC-2026-0122.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-vfvv-c25p-m7mm","url":"https://osv.dev/vulnerability/GHSA-vfvv-c25p-m7mm"}],"summary":"rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution"}