RUSTSEC-2026-0497

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0497

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0497.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0497

Aliases

GHSA-84xq-3662-pvx5

Published

2026-11-11T12:00:00Z

Modified

2026-11-12T08:00:03Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Transaction::from_json holds an input txid that is not 64 hex digits and writes the input as spending the zero txid

Details

Transaction::from_json, for a document with no hex member, held each input's txid member as given. An input txid that is not 64 hex digits ("zz", "", 63 or 65 digits, characters that are not hex digits) answered Ok: source_txid and to_json gave the text back, while to_binary wrote the input as spending the txid of 32 zero bytes and id() hashed those bytes. Documents naming different texts were one transaction, spending an outpoint none of them named.

An application that reads a peer's transaction document with from_json and relies both on the text of its inputs and on its bytes or id() is affected; one that reads only documents it produced is not.

0.8.6 refuses such a txid (Invalid txid of input N: expected 64 hex digits). Where upgrading is not possible, require each input's txid to be 64 ASCII hex digits before calling from_json.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / bsv-rs

Package

Name: bsv-rs; View open source insights on deps.dev
Purl: pkg:cargo/bsv-rs

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.8.6

Introduced

0.9.0-beta.1

Fixed

0.9.0-beta.7.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "bsv_rs::transaction::Transaction::from_json"
        ],
        "os": []
    }
}