rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

InlineVec::clear and SerVec::clear in rkyv were not panic-safe. Both functions iterate over their elements and call dropinplace on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value. A subsequent invocati...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.3) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

GHSA-VFVV-C25P-M7MM rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

InlineVec::clear and SerVec::clear in rkyv were not panic-safe. Both functions iterate over their elements and call dropinplace on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value. A subsequent invocati...

a1 (>=1.0.1, <=1.0.2), a1_notation (0.6.0) +606 more potentially affected by unknown CVE via rkyv (>=0.7.3, <=0.8.2)

rkyv CARGO version =0.7.3, =1.0.1, =0.2.2, =0.1.0, =0.23.0, =0.23.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.9.0, =0.0.1, =0.0.10 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0235...

PT-2026-67783

Shared pointer validation keyed already-validated pointees by their address and type, but did not include pointer metadata. For unsized pointees, an archive could therefore contain multiple Rc, Arc, or weak pointers that shared a data address but used different metadata, such as different slice...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.3) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.3) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

PT-2026-67782

The archive validator could accept certain malformed relative pointers and invalid ArchivedHashTable states. In particular, the hash table verifier did not ensure that the number of occupied buckets matched the table's declared length. A crafted archive could pass the checks performed by the safe...

PT-2026-67781

Insufficient archive range validation could allow a crafted archive to reach ArchivedString::deserialize with an invalid pointer. A reported reproducer used rkyv::from bytes to deserialize a struct containing strings, a vector, a box, and an optional hash map. AddressSanitizer detected a heap...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.3) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

PT-2026-39707

InlineVec::clear and SerVec::clear in rkyv were not panic-safe. Both functions iterate over their elements and call drop in place on each, updating self.len only after the loop. If an element's Drop implementation panics during the loop, self.len is left at its original value. A subsequent...

[SECURITY] Fedora 42 Update: rust-rkyv0.7-0.7.46-1.fc42

Zero-copy deserialization framework for Rust...

[SECURITY] Fedora 42 Update: rust-rkyv_derive0.7-0.7.46-1.fc42

Derive macro for rkyv...

[SECURITY] Fedora 43 Update: rust-rkyv_derive0.7-0.7.46-1.fc43

Derive macro for rkyv...

Fedora 43 : rust-rkyv0.7 / rust-rkyv_derive0.7 (2026-35d1dee2ab)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-35d1dee2ab advisory. https://rustsec.org/advisories/RUSTSEC-2026-0001 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora: Security Advisory (FEDORA-2026-35d1dee2ab)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 44 : rust-rkyv0.7 / rust-rkyv_derive0.7 (2026-f08ea66b23)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f08ea66b23 advisory. https://rustsec.org/advisories/RUSTSEC-2026-0001 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

CVE-2021-31919

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.3) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

acme-compilers (>=0.2.2, <=0.2.4), acvm (>=0.23.0, <=0.26.1) +296 more potentially affected by unknown CVE via rkyv (>=0.1.1, <=0.7.45)

rkyv CARGO version =0.1.1, =0.2.2, =0.23.0, =0.23.0, =0.0.1, =0.2.0, =0.39.0, =0.23.0, =0.26.1 - cairn-import-geonames 0.0.2-alpha - cairn-import-oa 0.0.2-alpha - cairn-import-osm 0.0.2-alpha - cairn-import-wof 0.0.2-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0001...