RUSTSEC-2026-0498

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0498

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0498.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0498

Aliases

GHSA-j8hr-pjhm-6h27
RUSTSEC-2026-0500

Published

2026-11-10T12:00:00Z

Modified

2026-11-12T08:11:08Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Transaction readers accept trailing bytes, so a parsed transaction can carry another transaction id

Details

Transaction::from_binary and Transaction::from_hex read one transaction from the front of their input, did not check that the input ended there, and kept the whole input as the transaction's cached serialization: to_binary, to_hex and id() then answered for bytes that are not the transaction's. Transaction::from_json, given a hex field, reads it through from_hex and answers the same. from_ef, from_hex_ef and parse_script_offsets also read a prefix.

An application that takes bytes or hex from outside, parses them with these readers and then uses id() or the serialization could be given one transaction under another identity: the same parsed fields, a different id. An application that passes them only bytes it produced or has already checked is not affected.

0.8.5 refuses a byte after the transaction; Transaction::from_reader reads from the front of a longer buffer. Where upgrading is not possible, parse with Transaction::from_binary, call tx.invalidate_caches() (public from 0.3.16) and require tx.to_binary() == bytes.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / bsv-rs

Package

Name: bsv-rs; View open source insights on deps.dev
Purl: pkg:cargo/bsv-rs

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.8.5

Introduced

0.9.0-beta.1

Fixed

0.9.0-beta.7.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "bsv_rs::transaction::Transaction::from_binary",
            "bsv_rs::transaction::Transaction::from_ef",
            "bsv_rs::transaction::Transaction::from_hex",
            "bsv_rs::transaction::Transaction::from_hex_ef",
            "bsv_rs::transaction::Transaction::from_json",
            "bsv_rs::transaction::Transaction::parse_script_offsets"
        ],
        "os": []
    }
}