PT-2025-39506 · Crates.Io · Libyaml

Published 2025-09-15 · Updated 2025-09-15

OSV

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

In version 0.0.4, libyml::string::yaml string extend was revised resulting in undefined behaviour, which is unsound.

The GitHub project for libyml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

• libyaml-safer
• unsafe-libyaml-norway - Maintained fork of unsafe-libyaml

Fix

Weakness Enumeration

CWE-758

Related Identifiers

GHSA-GFXP-F68G-8X78

Affected Products

Libyaml

References · 4

• https://osv.dev/vulnerability/GHSA-gfxp-f68g-8x78 · Vendor Advisory
• https://github.com/rustsec/advisory-db/issues/2395 · Note
• https://github.com/sebastienrousseau/libyml · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0067.html · Note