{"id":"GHSA-2326-pfpj-vx3h","summary":"lexical-core has multiple soundness issues","details":"`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.\n","aliases":["RUSTSEC-2023-0086"],"modified":"2026-09-10T03:50:55.529405940Z","published":"2024-09-16T17:19:01Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2024-09-16T17:19:01Z"},"references":[{"type":"WEB","url":"https://github.com/Alexhuszagh/rust-lexical/issues/101"},{"type":"WEB","url":"https://github.com/Alexhuszagh/rust-lexical/issues/102"},{"type":"WEB","url":"https://github.com/Alexhuszagh/rust-lexical/issues/104"},{"type":"WEB","url":"https://github.com/Alexhuszagh/rust-lexical/issues/126"},{"type":"WEB","url":"https://github.com/Alexhuszagh/rust-lexical/issues/95"},{"type":"PACKAGE","url":"https://github.com/Alexhuszagh/rust-lexical"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-c2hm-mjxv-89r4"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0055"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2023-0086.html"}],"affected":[{"package":{"name":"lexical-core","ecosystem":"crates.io","purl":"pkg:cargo/lexical-core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-2326-pfpj-vx3h/GHSA-2326-pfpj-vx3h.json"}}],"schema_version":"1.9.0"}