Skip to content
Fencer Intel
no cvss —

RUSTSEC-2026-0234 json

Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables

published 6mo ago modified 3mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

The archive validator could accept certain malformed relative pointers and invalid `ArchivedHashTable` states. In particular, the hash table verifier did not ensure that the number of occupied buckets matched the table's declared length.

A crafted archive could pass the checks performed by the safe `rkyv::access` and `rkyv::from_bytes` APIs and then cause an out-of-bounds read in later validation, lookup, or deserialization. Depending on the input, this could perform scalar or SIMD reads outside the archive buffer or crash the process.

Version 0.8.17 strengthens archive range validation and rejects hash tables whose number of occupied buckets does not match their declared length. Users who process untrusted archives should upgrade to 0.8.17 or later.

Patch / fix

  • crates.io rkyv 0.8.17

Is RUSTSEC-2026-0234 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io rkyv
>=0.8.0-rc.1, <0.8.17
0.8.17

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.