Skip to content
Fencer Intel
medium —

GHSA-9fjq-45qv-pcm7 json

ruint affected by unsoundness of safe `reciprocal_mg10`

published 10mo ago modified 10mo ago also RUSTSEC-2025-0137

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The function `reciprocal_mg10` is marked as safe but can trigger undefined behavior (out-of-bounds access) because it relies on `debug_assert!` for safety checks instead of `assert!`.

When compiled in release mode, the `debug_assert!` is optimized out, potentially allowing invalid inputs to cause memory corruption.

Patch / fix

  • crates.io ruint 1.17.1

Is GHSA-9fjq-45qv-pcm7 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io ruint
<=1.17.0
>=0.0.0-0, <1.17.1
1.17.1

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.