GitHub Advisoryadvisory · crates.io

GHSA-mj73-j457-8x9q maxminddb's `Reader::open_mmap` unsoundly marks unsafe memmap operation as safe

LOW Published 2025-12-02 Modified 2025-12-11 Official page ↗
Ecosystem
crates.io
Packages
maxminddb
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-915
Reviewed
2025-12-02

Affected packages

• crates.io maxminddb: >= 0.11.0, < 0.27.0 → fixed in 0.27.0

Description

maxminddb prior to version 0.27 declared `Reader::open_mmap` as safe despite wrapping an inherently unsafe memmap2 operation with no extra step done to guarantee safety. This could have led to undefined behaviour if the file were to be modified on disk while the memory map was still active.

Related

Weakness · CWE (1)

  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References