Skip to content
Fencer Intel
critical —

GHSA-5w5r-mf82-595p json

Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema

published 10mo ago modified 9mo ago also RUSTSEC-2025-0143

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.

## `Reader::get`

```rust pub fn get(&self) -> Result<<T as Owned>::Reader<'static>> { // ... // UNSAFE: access `words` without validation } ```

## `StructSchema::new`

```rust pub fn new(builder: RawBrandedStructSchema) -> StructSchema { // ... // UNSAFE: access encoded nodes without validation } ```

This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.

The issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.

Patch / fix

  • crates.io capnp 0.24.0

Is GHSA-5w5r-mf82-595p in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io capnp
<0.24.0
>=0.0.0-0, <0.24.0
0.24.0

Classification

Weakness
  • CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.