GHSA-rc23-xxgq-x27g json
wee_alloc is Unmaintained
published 4y ago modified 3y ago also RUSTSEC-2022-0054
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Two of the maintainers have indicated that the crate may not be maintained.
The crate has open issues including memory leaks and may not be suitable for production use.
It may be best to switch to the default Rust standard allocator on wasm32 targets.
Last release seems to have been three years ago.
Is GHSA-rc23-xxgq-x27g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | wee_alloc | all versions >=0.0.0-0 |
no fix listed |
References
-
github.com
/rustwasm/wee_alloc/issues/107
web, report
-
github.com
/rustwasm/wee_alloc
package
-
rustsec.org
/advisories/RUSTSEC-2022-0054.html
web, advisory
-
crates.io
/crates/wee_alloc
package
-
reddit.com
/r/rust/comments/x1cle0/dont_use_wee_alloc_in_production_code_targeting/
web
-
github.com
/rustwasm/wee_alloc/issues/85
report
-
github.com
/rustwasm/wee_alloc/issues/106
report
Sources
- GitHub Advisory GHSA-rc23-xxgq-x27g
- OSV RUSTSEC-2022-0054
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.