RUSTSEC-2026-0080

See a problem?
Please try reporting it to the source first.
Source
https://rustsec.org/advisories/RUSTSEC-2026-0080
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0080.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2026-0080
Aliases
Published
2026-01-19T12:00:00Z
Modified
2026-04-05T05:30:42Z
Summary
Multiple soundness issues in `scaly` safe APIs
Details

Affected versions contain multiple safe APIs that can trigger undefined behavior:

  • Array<T>::index can perform an out-of-bounds read.
  • String::get_length can perform an out-of-bounds read.
  • String::append_character can perform an invalid write.
  • String::to_c_string can perform an out-of-bounds write.

These issues were reproduced against scaly 0.0.37 under Miri. And the crate is unmaintained.

Database specific 
{
    "license": "CC0-1.0"
}
References

Affected packages

crates.io / scaly

Package

Name
scaly
View open source insights on deps.dev
Purl
pkg:cargo/scaly

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0

Ecosystem specific 

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}

Database specific

categories 
[]
cvss 
null
informational 
"unsound"
source 
"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0080.json"