Read the docs
TI-2024-39095 Aliases GHSA-f95p-4cv5-8w8x

linkme fails to ensure slice elements match the slice's declared type

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Affected versions allow populating a DistributedSlice of T with elements of an arbitrary other type that coerces to T. For example, elements of type `&&str` could end up in a slice of type `[&str]`, since `&&str` coerces to `&str` via a deref coercion. The flaw was corrected by implementing typechecking for distributed slice elements in such a way that coercion no longer occurs. The element's type must be a subtype of the slice's declared element type.

Why it matters now

Fix Fixed linkme (crates.io): 0.3.24

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—linkme (crates.io)before 0.3.240.3.24Patch availableGHSA-f95p-4cv5-8w8x
  • linkme (crates.io) Vendor— Affected before 0.3.24 Fixed in 0.3.24 Patch available GHSA-f95p-4cv5-8w8x

Remediation

  • Fix · GHSA-f95p-4cv5-8w8x linkme (crates.io) Fixed in 0.3.24 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-f95p-4cv5-8w8x

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences