{"id":"RUSTSEC-2026-0220","summary":"Uint shift operations: incorrect overflow flags and truncated shift amounts","details":"`Uint::overflowing_shl`/`overflowing_shr` returned false-negative overflow\nflags. `overflowing_shl` missed bits shifted above `BITS` but within the top\nlimb (non-limb-aligned widths such as `U160`), and limbs wholly discarded by\nshifts \u003e= 64; `overflowing_shr` missed wholly discarded low limbs. Shifted\nvalues were correct; only the flag was wrong.\n\nThe wrong flag propagates: `checked_shl`/`checked_shr` return `Some` instead\nof `None`, `strict_*` fail to panic, and `saturating_*` return a wrapped\nvalue instead of saturating. The incorrect `checked_shl` result causes\n`to_base_be` (and string formatting) to loop forever on no-alloc builds for\nnon-limb-aligned widths — a denial of service if formatting is reachable\nfrom untrusted input.\n\nSeparately, `wrapping_shl`/`wrapping_shr` on 64/128/256-bit types truncated\nthe shift amount modulo 2^32, so shifts \u003e= 2^32 returned an incorrectly\nwrapped value instead of zero; on 32-bit targets the generic path also\ntruncated 64-bit shift amounts.\n\nCallers using checked or saturating shift semantics on untrusted shift\namounts may compute incorrect results.","modified":"2026-07-30T19:15:04.025918010Z","published":"2026-07-08T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/ruint"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0220.html"},{"type":"WEB","url":"https://github.com/alloy-rs/ruint/pull/603"}],"affected":[{"package":{"name":"ruint","ecosystem":"crates.io","purl":"pkg:cargo/ruint"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.20.0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["ruint::Uint::checked_shl","ruint::Uint::checked_shr","ruint::Uint::overflowing_shl","ruint::Uint::overflowing_shr","ruint::Uint::saturating_shl","ruint::Uint::saturating_shr","ruint::Uint::wrapping_shl","ruint::Uint::wrapping_shr"],"arch":[]},"affected_functions":null},"database_specific":{"informational":null,"categories":["denial-of-service"],"cvss":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0220.json"}}],"schema_version":"1.7.5"}