{"action":"Upgrade rkyv to 0.8.16 or later.","affected":[{"fixed":"0.8.16","introduced":"0.8.0"}],"component":"rkyv","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.8.16"],"ghsa_id":"GHSA-vfvv-c25p-m7mm","id":"tcs_01M5KFBCSCQA62VQEMVPNMEK1J","modified_at":"2026-05-16T07:08:02Z","published_at":"2026-04-23T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0122","https://crates.io/crates/rkyv","https://rustsec.org/advisories/RUSTSEC-2026-0122.html","https://github.com/rkyv/rkyv/commit/5828cf5c27b664eb4432c4a93d4769e12e5e42fb"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0122","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0122"}],"summary":"Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`"}