PT-2025-39506 · Crates.Io · Libyaml

Publicado 2025-09-15 · Atualizado 2025-09-15

OSV

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

In version 0.0.4, libyml::string::yaml string extend was revised resulting in undefined behaviour, which is unsound.

The GitHub project for libyml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

• libyaml-safer
• unsafe-libyaml-norway - Maintained fork of unsafe-libyaml

Correção

Enumeração de Fraquezas

CWE-758

Identificadores relacionados

GHSA-GFXP-F68G-8X78

Produtos afetados

Libyaml

Referências · 4

• https://github.com/rustsec/advisory-db/issues/2395 · Nota
• https://github.com/sebastienrousseau/libyml · Nota
• https://rustsec.org/advisories/RUSTSEC-2025-0067.html · Nota
• https://osv.dev/vulnerability/GHSA-gfxp-f68g-8x78 · Aviso do Fabricante