GitHub Advisoryadvisory · crates.io
GHSA-2c6h-4899-wjxr scaly: Multiple soundness issues in Rust safe APIs
HIGH
Official page ↗
- Ecosystem
- crates.io
- Packages
- scaly
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-125, CWE-787
- Reviewed
- 2026-04-04
Affected packages
• crates.io scaly: <= 0.0.37 (no fix yet)
Description
Affected versions contain multiple safe APIs that can trigger undefined behavior:
• `Array::index` can perform an out-of-bounds read.
• `String::get_length` can perform an out-of-bounds read.
• `String::append_character` can perform an invalid write.
• `String::to_c_string` can perform an out-of-bounds write.
These issues were reproduced against `scaly` 0.0.37 under Miri. The crate is unmaintained.