{"id":"RUSTSEC-2025-0143","summary":"Unsound APIs of public `constant::Reader` and `StructSchema`","details":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(&self) -\u003e Result\u003c\u003cT as Owned\u003e::Reader\u003c'static\u003e\u003e {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -\u003e StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","aliases":["GHSA-5w5r-mf82-595p"],"modified":"2026-01-29T06:11:15.854620Z","published":"2025-12-24T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/capnp"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2025-0143.html"},{"type":"REPORT","url":"https://github.com/capnproto/capnproto-rust/issues/605"}],"affected":[{"package":{"name":"capnp","ecosystem":"crates.io","purl":"pkg:cargo/capnp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.24.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":["capnp::constant::Reader::get","capnp::schema::StructSchema::new"],"os":[]}},"database_specific":{"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0143.json","categories":["memory-corruption"],"cvss":null,"informational":null}}],"schema_version":"1.7.3"}