{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "memory-corruption"
        ],
        "cvss": null,
        "informational": "unsound"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "ssdeep",
        "purl": "pkg:cargo/ssdeep"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The `Context` struct has all fields public (`pub d_len`, `pub digest`, etc.).\nCode from other modules within the same crate can directly modify `d_len` to a\nvalue exceeding the `digest` vector length. When `reset()` is subsequently\ncalled, `self.digest[self.d_len as usize] = 0` becomes an out-of-bounds write.\n\n## Withdrawal\nThis advisory has been withdrawn because the above unsoundness cannot be\ntriggered in safe code by dependents of the crate, as the `Context` struct\nis not public. It merely represents an opportunity for improvement for the\ncrate\u0027s internals.",
  "id": "RUSTSEC-2026-0132",
  "modified": "2026-05-17T20:07:58Z",
  "published": "2026-05-02T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/ssdeep"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0132.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rustysec/fuzzyhash-rs/issues/14"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Potential out-of-bounds write via public `Context` fields",
  "withdrawn": "2026-05-17T12:00:00Z"
}