GitHub Advisoryadvisory · crates.io

GHSA-gfxp-f68g-8x78 LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained

HIGH Published 2025-09-15 Modified 2025-09-15 Official page ↗
Ecosystem
crates.io
Packages
libyml
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-758
Reviewed
2025-09-15

Affected packages

• crates.io libyml: >= 0.0.4, <= 0.0.5 (no fix yet)

Description

In version 0.0.4, `libyml::string::yaml_string_extend` was revised resulting in undefined behaviour, which is unsound. The GitHub project for `libyml` was archived after unsoundness issues were raised. If you rely on this crate, it is highly recommended switching to a maintained alternative. Recommended alternatives • `libyaml-safer` • `unsafe-libyaml-norway` - Maintained fork of `unsafe-libyaml`

Related

Weakness · CWE (1)

  • CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior weakness

References