RUSTSEC-2026-0202

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0202

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0202.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0202

Published

2026-07-05T12:00:00Z

Modified

2026-07-05T08:45:04Z

Summary

`let_cxx_string!` uses uninitialized value due to exception safety violations

Details

In affected versions of this crate, let_cxx_string! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitialized value.

The soundness issue was fixed in version 1.0.195 by moving drop logics to separate drop guard after initializing the StackString.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / cxx

Package

Name: cxx; View open source insights on deps.dev
Purl: pkg:cargo/cxx

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

1.0.195

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "cxx::let_cxx_string"
        ],
        "os": []
    }
}