GitHub Advisoryadvisory · crates.io

GHSA-6mw6-mj76-grwc gix-date can create non-utf8 string with `TimeBuf::as_str`

MEDIUM Published 2026-01-05 Modified 2026-01-27 Official page ↗
Aliases
CVE-2026-0810
Ecosystem
crates.io
Packages
gix-date
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-787
Reviewed
2026-01-05

Affected packages

• crates.io gix-date: < 0.12.0 → fixed in 0.12.0

Description

The function `gix_date::parse::TimeBuf::as_str` can create an illegal string containing non-utf8 characters. This violates the safety invariant of `TimeBuf` and can lead to undefined behavior when consuming the string. The bug can be prevented by adding `str::from_utf8` to the function `TimeBuf::write`.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References