{"id":"RUSTSEC-2026-0183","summary":"Potential undefined behavior when calling Remote::list()","details":"When calling `Remote::list()` for a remote of a git repository, when that remote does not advertise any references, git2 passes a null pointer to the unsafe function `slice::from_raw_parts()`. Based on the safety section documentation of function, data must be non-null even for slices of length zero. Thus, the use of a null pointer leads to undefined behavior.","modified":"2026-06-17T13:00:04.696626611Z","published":"2026-05-12T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/git2"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0183.html"},{"type":"WEB","url":"https://github.com/rust-lang/git2-rs/pull/1250"}],"affected":[{"package":{"name":"git2","ecosystem":"crates.io","purl":"pkg:cargo/git2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.21.0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":[],"arch":[]},"affected_functions":null},"database_specific":{"categories":[],"cvss":null,"informational":"unsound","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0183.json"}}],"schema_version":"1.7.5"}