RUSTSEC-2025-0143

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0143

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0143.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2025-0143

Aliases

GHSA-5w5r-mf82-595p

Published

2025-12-24T12:00:00Z

Modified

2026-01-29T06:11:15Z

Summary

Unsound APIs of public `constant::Reader` and `StructSchema`

Details

The safe API functions constant::Reader::get and StructSchema::new rely on PointerReader::get_root_unchecked, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.

`Reader::get`

pub fn get(&self) -> Result<<T as Owned>::Reader<'static>> {
    // ...
    // UNSAFE: access `words` without validation
}

`StructSchema::new`

pub fn new(builder: RawBrandedStructSchema) -> StructSchema {
    // ...
    // UNSAFE: access encoded nodes without validation
}

This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.

The issue is resolved in version 0.24.0 by making constructor functions unsafe and mark the fields of struct as visible only in the crate.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / capnp

Package

Name: capnp; View open source insights on deps.dev
Purl: pkg:cargo/capnp

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.24.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "capnp::constant::Reader::get",
            "capnp::schema::StructSchema::new"
        ],
        "os": []
    }
}