{"id":"RUSTSEC-2026-0498","summary":"Transaction readers accept trailing bytes, so a parsed transaction can carry another transaction id","details":"`Transaction::from_binary` and `Transaction::from_hex` read one transaction\nfrom the front of their input, did not check that the input ended there, and\nkept the whole input as the transaction's cached serialization: `to_binary`,\n`to_hex` and `id()` then answered for bytes that are not the transaction's.\n`Transaction::from_json`, given a `hex` field, reads it through `from_hex` and\nanswers the same. `from_ef`, `from_hex_ef` and `parse_script_offsets` also\nread a prefix.\n\nAn application that takes bytes or hex from outside, parses them with these\nreaders and then uses `id()` or the serialization could be given one\ntransaction under another identity: the same parsed fields, a different id.\nAn application that passes them only bytes it produced or has already checked\nis not affected.\n\n0.8.5 refuses a byte after the transaction; `Transaction::from_reader` reads\nfrom the front of a longer buffer. Where upgrading is not possible, parse with\n`Transaction::from_binary`, call `tx.invalidate_caches()` (public from 0.3.16)\nand require `tx.to_binary() == bytes`.","aliases":["GHSA-j8hr-pjhm-6h27","RUSTSEC-2026-0500"],"modified":"2026-11-12T08:11:08.643204332Z","published":"2026-11-10T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/bsv-rs"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0498.html"},{"type":"WEB","url":"https://github.com/Calhooon/bsv-rs/blob/v0.8.5/CHANGELOG.md"},{"type":"REPORT","url":"https://github.com/Calhooon/bsv-rs/issues/840"}],"affected":[{"package":{"name":"bsv-rs","ecosystem":"crates.io","purl":"pkg:cargo/bsv-rs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.8.5"},{"introduced":"0.9.0-beta.1"},{"fixed":"0.9.0-beta.7.0"}]}],"ecosystem_specific":{"affected_functions":null,"affects":{"os":[],"functions":["bsv_rs::transaction::Transaction::from_binary","bsv_rs::transaction::Transaction::from_ef","bsv_rs::transaction::Transaction::from_hex","bsv_rs::transaction::Transaction::from_hex_ef","bsv_rs::transaction::Transaction::from_json","bsv_rs::transaction::Transaction::parse_script_offsets"],"arch":[]}},"database_specific":{"categories":["crypto-failure"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0498.json","informational":null}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}