Read the docs
TI-2024-39037 Aliases GHSA-2326-pfpj-vx3h

lexical-core has multiple soundness issues

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

`RUSTSEC-2024-0377` contains multiple soundness issues: 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102) 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101) 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104) 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95) 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126) Version 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.

Why it matters now

Fix Fixed lexical-core (crates.io): 1.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—lexical-core (crates.io)before 1.0.01.0.0Patch availableGHSA-2326-pfpj-vx3h
  • lexical-core (crates.io) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-2326-pfpj-vx3h

Remediation

  • Fix · GHSA-2326-pfpj-vx3h lexical-core (crates.io) Fixed in 1.0.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-2326-pfpj-vx3h

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences