{"id":"RUSTSEC-2026-0497","summary":"Transaction::from_json holds an input txid that is not 64 hex digits and writes the input as spending the zero txid","details":"`Transaction::from_json`, for a document with no `hex` member, held each\ninput's `txid` member as given. An input `txid` that is not 64 hex digits\n(`\"zz\"`, `\"\"`, 63 or 65 digits, characters that are not hex digits) answered\n`Ok`: `source_txid` and `to_json` gave the text back, while `to_binary` wrote\nthe input as spending the txid of 32 zero bytes and `id()` hashed those bytes.\nDocuments naming different texts were one transaction, spending an outpoint\nnone of them named.\n\nAn application that reads a peer's transaction document with `from_json` and\nrelies both on the text of its inputs and on its bytes or `id()` is affected;\none that reads only documents it produced is not.\n\n0.8.6 refuses such a txid (`Invalid txid of input N: expected 64 hex digits`).\nWhere upgrading is not possible, require each input's `txid` to be 64 ASCII hex\ndigits before calling `from_json`.","aliases":["GHSA-84xq-3662-pvx5"],"modified":"2026-11-12T08:00:03.171704098Z","published":"2026-11-11T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/bsv-rs"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0497.html"},{"type":"WEB","url":"https://github.com/Calhooon/bsv-rs/blob/v0.8.6/CHANGELOG.md"},{"type":"REPORT","url":"https://github.com/Calhooon/bsv-rs/issues/845"},{"type":"WEB","url":"https://github.com/Calhooon/bsv-rs/pull/856"}],"affected":[{"package":{"name":"bsv-rs","ecosystem":"crates.io","purl":"pkg:cargo/bsv-rs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.8.6"},{"introduced":"0.9.0-beta.1"},{"fixed":"0.9.0-beta.7.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"functions":["bsv_rs::transaction::Transaction::from_json"],"arch":[],"os":[]}},"database_specific":{"categories":[],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0497.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}