Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

xxhash-rust

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.3crates.ioAmendedPublished

    xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

    GHSA-6g2r-675j-hx59

    Affected
    • crates.io xxhash-rust < 0.8.16
    Fixed in
    0.8.16· Vendor fix available
    Issue
    I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhashrust::xxh3::xxh364withsecret(&[0x41], &[]) The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debugassert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation. Observed diagnostic: Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri. Local artifacts: - vulnerable log: artifacts/logs/W-4332xxhashrustshortsecretmirireleaselinux001.log - repair log: artifacts/logs/differentials/W-4332xxhashrustlocalrepairmirireleaselinux001.log - report: artifacts/reports/W-4332xxhashrustshortsecretreport.md

    Recommended action: Upgrade to 0.8.16 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →