Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

iceoryx2-bb-container

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Unsoundness in UTF-8 'String' trait

    CVE-2026-92612 · GHSA-8mq4-3mwq-qvg6

    Affected
    • crates.io iceoryx2-bb-container >= 0.0.0-0, < 0.10.0; >= 0.11.0-0
    Fixed in
    0.10.0· Partial vendor fix
    Issue
    The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust. The API methods `as_mut_bytes` and `deref_mut` where removed from the String API and their implementations (PolymorphicString, RelocatableString, and StaticString ) without replacement. Link to Pull-Request: https://github.com/eclipse-iceoryx/iceoryx2/pull/1956

    Recommended action: Upgrade to 0.10.0; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →