{"id":"RUSTSEC-2026-0132","summary":"Potential out-of-bounds write via public `Context` fields","details":"The `Context` struct has all fields public (`pub d_len`, `pub digest`, etc.).\nCode from other modules within the same crate can directly modify `d_len` to a\nvalue exceeding the `digest` vector length. When `reset()` is subsequently\ncalled, `self.digest[self.d_len as usize] = 0` becomes an out-of-bounds write.\n\n## Withdrawal\nThis advisory has been withdrawn because the above unsoundness cannot be\ntriggered in safe code by dependents of the crate, as the `Context` struct\nis not public. It merely represents an opportunity for improvement for the\ncrate's internals.","modified":"2026-05-17T20:15:11.414569Z","published":"2026-05-02T12:00:00Z","withdrawn":"2026-05-17T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/ssdeep"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0132.html"},{"type":"REPORT","url":"https://github.com/rustysec/fuzzyhash-rs/issues/14"}],"affected":[{"package":{"name":"ssdeep","ecosystem":"crates.io","purl":"pkg:cargo/ssdeep"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affects":{"functions":[],"os":[],"arch":[]},"affected_functions":null},"database_specific":{"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0132.json","categories":["memory-corruption"]}}],"schema_version":"1.7.5"}