Skip to content
Fencer Intel
no cvss —

RUSTSEC-2026-0129 json

Buffer overflow in `Clusterings::from_i32_column_major_order()`

published 6mo ago modified 5mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The `from_i32_column_major_order` method can create inconsistent internal state. When `labels` length and `n_items` mismatch, `n_clusterings` becomes `labels.len() / n_items` (truncated), but subsequent calls to `label()` use indices that exceed the internal data bounds, causing a buffer overflow.

For example, `Clusterings::from_i32_column_major_order(&[1,2,3,4,5], 3)` creates clusterings with `n_clusterings = 5/3 = 1`. Then `clusterings.label(1, 0)` accesses index `1*3 = 3`, but only 3 elements exist (indices 0,1,2), causing out-of-bounds access.

This can be triggered through safe public APIs — `from_i32_column_major_order()` and `label()` — with no `unsafe` required from the caller.

Patch / fix

  • crates.io dahl-salso 0.6.8

Is RUSTSEC-2026-0129 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io dahl-salso
>=0.0.0-0, <0.6.8
0.6.8

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.