Vulnerability RUSTSEC-2026-0500

Beef::merge_raw_tx and BeefTx::from_raw_tx accept raw bytes without a Result. For bytes that are not exactly one transaction (a transaction followed by bytes, a cut transaction, bytes that are no transaction at all), Beef::sort_txs, verify_structure, verify_valid and is_valid could answer valid, even with no BUMP and no parent in the BEEF, and, where the entry carried a BUMP index, treat the hash of those bytes as a proven transaction id; an entry that names it as a parent was answered valid too.

The wire readers (Beef::from_binary, verify_stream, Transaction::from_beef, from_atomic_beef) parse every entry and are not affected. Reaching this needs an application that passes bytes it did not parse to merge_raw_tx or BeefTx::from_raw_tx and then relies on the verdict or on the transaction the BEEF hands back.

0.8.5 refuses such an entry at all four verdict doors, with or without a BUMP index, and every entry that names it as a parent. Where upgrading is not possible, do not rely on is_valid or verify_valid alone for such an entry: check that the bytes are exactly one transaction before merging them.