RUSTSEC-2026-0001

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0001

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0001.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0001

Published

2026-01-05T12:00:00Z

Modified

2026-01-06T15:50:23Z

Summary

Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM

Details

The SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).

This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.

The issue is reachable through safe code and violates Rust's safety guarantees.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / rkyv

Package

Name: rkyv; View open source insights on deps.dev
Purl: pkg:cargo/rkyv

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.7.46

Introduced

0.8.0

Fixed

0.8.13

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}