PT-2025-38664 · Crates.Io · Libyaml

Published 2025-09-11 · Updated 2025-09-11

OSV

In version 0.0.4, libyml::string::yaml string extend was revised resulting in undefined behaviour, which is unsound.

The GitHub project for libyml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

• libyaml-safer
• unsafe-libyaml-norway - Maintained fork of unsafe-libyaml

Related Identifiers

RUSTSEC-2025-0067

Affected Products

Libyaml

References · 4

• https://osv.dev/vulnerability/RUSTSEC-2025-0067 · Vendor Advisory
• https://github.com/rustsec/advisory-db/issues/2395 · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0067.html · Note
• https://crates.io/crates/libyml · Note