GHSA-x43w-ph7m-pfjx json
hexchat crate has a Use After Free vulnerability
published 11mo ago modified 8mo ago also RUSTSEC-2025-0153
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
All versions of this crate have function `deregister_command` which can result in use after free. This is unsound.
In addition, all versions since 0.3.0 have "safe" macros, which are documented as unsafe to use in threads.
In addition, the `hexchat` crate is no longer actively maintained. If users rely on this crate, consider switching to an alternative.
Is GHSA-x43w-ph7m-pfjx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | hexchat | <=0.6.3 >=0.0.0-0 |
no fix listed |
Classification
- Weakness
-
- CWE-416 Use After Free
References
-
github.com
/pie-flavor/hexchat-rs/issues/3
web, report
-
github.com
/pie-flavor/hexchat-rs
package
-
rustsec.org
/advisories/RUSTSEC-2025-0153.html
web, advisory
-
crates.io
/crates/hexchat
package
Sources
- GitHub Advisory GHSA-x43w-ph7m-pfjx
- OSV RUSTSEC-2025-0153
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.