Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    RUSTSEC-2026-0333 (GHSA-4XCC-23FX-W2WJ)

    Vulnerability from osv_rustsec – Published: 2026-10-06 12:00 – Updated: 2026-10-08 14:47 – Source website
    VLAI
    Summary
    Resource budgets not enforced on the typed deserialization path
    Details

    ParserConfig::max_events, max_nodes, max_total_scalar_bytes, max_merge_keys, alias_anchor_ratio and the alias jump factor were enforced only by the two Value loaders. A typed target with a default-shaped configuration is served by the streaming deserializer, which never read those fields, so tightening any of them had no effect on from_str::<T> for a struct target. The default document-length, depth and alias-count caps were enforced on every path, so no input was unbounded; the gap affects callers who tightened the other budgets for hostile input.

    Version 0.0.53 charges every budget on the streaming path as well and adds cross-path parity tests.

    Users who cannot upgrade can deserialize into noyalib::Value first and convert with from_value, or rely on max_document_length and max_depth, which were always applied on every path.

    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "noyalib::from_reader",
            "noyalib::from_reader_with_config",
            "noyalib::from_slice",
            "noyalib::from_slice_with_config",
            "noyalib::from_str",
            "noyalib::from_str_with_config"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "noyalib",
        "purl": "pkg:cargo/noyalib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.0.53"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-4xcc-23fx-w2wj"
  ],
  "database_specific": {
    "license": "CC-BY-4.0"
  },
  "details": "`ParserConfig::max_events`, `max_nodes`, `max_total_scalar_bytes`,\n`max_merge_keys`, `alias_anchor_ratio` and the alias jump factor were\nenforced only by the two `Value` loaders. A typed target with a\ndefault-shaped configuration is served by the streaming deserializer,\nwhich never read those fields, so tightening any of them had no effect\non `from_str::\u003cT\u003e` for a struct target. The default document-length,\ndepth and alias-count caps were enforced on every path, so no input was\nunbounded; the gap affects callers who tightened the other budgets for\nhostile input.\n\nVersion 0.0.53 charges every budget on the streaming path as well and\nadds cross-path parity tests.\n\nUsers who cannot upgrade can deserialize into `noyalib::Value` first and\nconvert with `from_value`, or rely on `max_document_length` and\n`max_depth`, which were always applied on every path.",
  "id": "RUSTSEC-2026-0333",
  "modified": "2026-10-08T14:47:14Z",
  "published": "2026-10-06T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/noyalib"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0333.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastienrousseau/noyalib/pull/470"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Resource budgets not enforced on the typed deserialization path"
}