Loading story…
Multiple vulnerabilities in the Rust serialization crate rkyv allow crafted untrusted archives to bypass validation in supposedly safe checked deserialization paths and trigger memory safety failures. RustSec advisories RUSTSEC-2026-0233, RUSTSEC-2026-0234, and RUSTSEC-2026-0235 describe flaws that can lead to a heap use-after-free in ArchivedString::deserialize, out-of-bounds reads in archives containing hash tables, and out-of-bounds reads involving Rc/Arc shared pointers. Affected safe APIs include rkyv::access and rkyv::from_bytes, and the resulting impact includes process crashes, denial of service, and potential memory exposure when applications process attacker-controlled archive bytes.
The issues were fixed in rkyv 0.8.17, which strengthens archive range validation, rejects malformed relative pointers and inconsistent hash table states, and hardens shared-pointer verification. An upstream code change shows the project now validates shared pointers using both erased data pointers and pointer metadata, explicitly detecting conflicting metadata such as forged slice lengths that reference the same memory region. The maintainers said the 0.7 series is also affected but unsupported, and advised users handling untrusted archives to upgrade to 0.8.17 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
RustSec issued advisories for three distinct rkyv flaws: a use-after-free during deserialization, out-of-bounds reads involving hash tables, and out-of-bounds reads involving Rc/Arc validation. The advisories state that rkyv 0.8.17 fixes the issues and recommend upgrading when processing untrusted archives.
A code commit updated rkyv validation to track erased pointer metadata for shared pointers and detect metadata mismatches, addressing the Rc/Arc validation issue and related unsafe archive handling.
A vulnerability affecting rkyv shared-pointer validation was reported, showing that conflicting metadata on Rc/Arc-style pointers could bypass validation and enable out-of-bounds reads through safe APIs.
A second rkyv vulnerability was reported involving malformed relative pointers and invalid ArchivedHashTable states that could later cause out-of-bounds reads, memory exposure, or denial of service.
A vulnerability in rkyv's archive range validation was reported, describing how a crafted archive could lead to an invalid pointer reaching string deserialization and trigger a heap use-after-free.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
rustsec.org
Open sourcerustsec.org
Open sourcerustsec.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Rust Security Response Team disclosed **Cargo** vulnerabilities tracked as `CVE-2026-5222` and `CVE-2026-5223`, highlighting risks in how Rust tooling processes package archives from **third-party registries**. In the published details for `CVE-2026-5223`, Cargo was found to mishandle symlinks inside crate tarballs, allowing a malicious crate to overwrite the cached source of another crate from the same registry by extracting files outside its intended cache path. The issue does **not** affect `crates.io`, which already blocks crates containing symlinks, but it affects Cargo versions shipped before **Rust 1.96.0**; the fix rejects extraction of any symlink found in crate tarballs. The disclosures align with a separate advisory affecting the Rust package **astral-tokio-tar**, where a **PAX header desynchronization** bug in versions before `0.6.2` can cause tar archives to be interpreted differently from other implementations. That flaw can let attackers hide or reveal archive members unexpectedly and potentially smuggle files onto a victim filesystem during extraction. Together, the advisories underscore a broader supply-chain risk in Rust archive handling: malformed tar metadata and symlink processing can let malicious packages alter extracted contents in ways developers and automated tooling may not expect. Users are advised to upgrade to fixed releases and, where upgrades are not yet possible, audit registry content and block symlinks in published crates.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026
A high-severity vulnerability, tracked as CVE-2025-62518 and codenamed TARmageddon, was discovered in the async-tar Rust library and its numerous forks, including tokio-tar, astral-tokio-tar, krata-tokio-tar, and others. The flaw, which carries a CVSS score of 8.1, allows for remote code execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends. The vulnerability stems from inconsistent handling of PAX extended headers and ustar headers when determining file data boundaries, specifically when processing archives with PAX-extended headers containing size overrides. This parsing error enables attackers to smuggle additional archive entries by exploiting the mismatch, causing the parser to interpret file content as legitimate TAR headers. The async-tar library and its forks are widely used in critical tools and environments, including the uv Python package manager, testcontainers, and wasmCloud, amplifying the potential impact of the flaw. The most popular fork, tokio-tar, has over 5 million downloads on crates.io but is no longer maintained, increasing the risk as users may not receive timely patches. Edera, the security company that discovered the vulnerability in August 2025, highlighted the systemic risk posed by the open-source abandonware crisis, as the bug was inherited by a deep lineage of forks after the original project became unmaintained. Edera created and distributed patches for active forks, with astral-tokio-tar releasing version 0.5.6 to remediate the issue. However, users of unmaintained forks like tokio-tar are advised to migrate to patched alternatives such as astral-tokio-tar. The vulnerability's discovery underscores the challenges in tracking and patching security flaws in widely forked and abandoned open-source projects. The flaw's presence in foundational libraries for async archive processing in the Rust ecosystem means that build systems and production environments across many organizations could be at risk. Security experts warn that the lack of visibility into the use of these libraries further complicates mitigation efforts. The incident has reignited discussions about the need for better maintenance and oversight of critical open-source infrastructure. Organizations relying on affected libraries are urged to assess their exposure and implement available patches or migrate to maintained alternatives immediately. The coordinated disclosure and patching efforts by Edera aimed to minimize the window of exploitation before public announcement. This event highlights the importance of proactive vulnerability management and the risks associated with relying on unmaintained open-source components.
Jun 29, 2026