RUSTSEC-2026-0129 json
Buffer overflow in `Clusterings::from_i32_column_major_order()`
published 6mo ago modified 5mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The `from_i32_column_major_order` method can create inconsistent internal state. When `labels` length and `n_items` mismatch, `n_clusterings` becomes `labels.len() / n_items` (truncated), but subsequent calls to `label()` use indices that exceed the internal data bounds, causing a buffer overflow.
For example, `Clusterings::from_i32_column_major_order(&[1,2,3,4,5], 3)` creates clusterings with `n_clusterings = 5/3 = 1`. Then `clusterings.label(1, 0)` accesses index `1*3 = 3`, but only 3 elements exist (indices 0,1,2), causing out-of-bounds access.
This can be triggered through safe public APIs — `from_i32_column_major_order()` and `label()` — with no `unsafe` required from the caller.
Patch / fix
- crates.io dahl-salso 0.6.8
Is RUSTSEC-2026-0129 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | dahl-salso | >=0.0.0-0, <0.6.8 |
0.6.8 |
References
Sources
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.