Vulnerability RUSTSEC-2022-0068
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 years ago
November 30, 2022 at 12:00 PM UTC
out-of-bounds read possible when setting list-of-pointers
>=0.0.0-0 <0.13.7, >=0.14.0-0 <0.14.11, >=0.15.0-0 <0.15.2
>=0.0.0-0 <0.13.7, >=0.14.0-0 <0.14.11, >=0.15.0-0 <0.15.2
Summary
out-of-bounds read possible when setting list-of-pointers
Details
If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data.
The C++ Cap'n Proto library is also affected by this bug. See the advisory on the main Cap'n Proto repo for a succinct description of the exact circumstances in which the problem can arise.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
9 months ago
Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema
<0.24.0 GHSA-5w5r-mf82-595p
<0.24.0 GHSA-5w5r-mf82-595p
Unknown
10 months ago
Unsound APIs of public `constant::Reader` and `StructSchema`
>=0.0.0-0 <0.24.0 RUSTSEC-2025-0143
>=0.0.0-0 <0.24.0 RUSTSEC-2025-0143
Medium Risk
3 years ago
Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list
>=0.15.0 <0.15.2, >=0.14.0 <0.14.11, <0.13.7 GHSA-qqff-4vw4-f6hx
>=0.15.0 <0.15.2, >=0.14.0 <0.14.11, <0.13.7 GHSA-qqff-4vw4-f6hx
Impacted packages
Timeline
Published
3 years ago
November 30, 2022 at 12:00 PM UTC
Fixed (0.15.2)
3 years ago
November 30, 2022 at 02:57 PM UTC
Fixed (0.14.11)
3 years ago
November 30, 2022 at 03:03 PM UTC
Fixed (0.13.7)
3 years ago
November 30, 2022 at 03:03 PM UTC
Last Modified
13 hours ago
November 09, 2026 at 11:00 AM UTC