{"id":"GHSA-5w5r-mf82-595p","summary":"Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema","details":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(&self) -\u003e Result\u003c\u003cT as Owned\u003e::Reader\u003c'static\u003e\u003e {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -\u003e StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","aliases":["RUSTSEC-2025-0143"],"modified":"2026-02-03T03:06:53.944791Z","published":"2026-01-28T16:06:09Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-758"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-01-28T16:06:09Z"},"references":[{"type":"WEB","url":"https://github.com/capnproto/capnproto-rust/issues/605"},{"type":"WEB","url":"https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf"},{"type":"WEB","url":"https://github.com/capnproto/capnproto-rust/commit/e3aeec213e6d1b30a182bf61682a370f20d8a02c"},{"type":"PACKAGE","url":"https://github.com/capnproto/capnproto-rust"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0143.html"}],"affected":[{"package":{"name":"capnp","ecosystem":"crates.io","purl":"pkg:cargo/capnp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.24.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-5w5r-mf82-595p/GHSA-5w5r-mf82-595p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}