{"action":"Upgrade rkyv to 0.7.46 or later.","affected":[{"fixed":"0.7.46","introduced":"0.0.0-0"},{"fixed":"0.8.13","introduced":"0.8.0"}],"component":"rkyv","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.7.46","0.8.13"],"id":"tcs_01M5KFANXNDQ85W4QF926MH2A4","modified_at":"2026-01-06T15:50:23.269686Z","published_at":"2026-01-05T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0001","https://crates.io/crates/rkyv","https://rustsec.org/advisories/RUSTSEC-2026-0001.html","https://github.com/rkyv/rkyv/issues/644"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0001","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0001"}],"summary":"Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM"}