RUSTSEC-2026-0529

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0529

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0529.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0529

Aliases

GHSA-mj2m-jxgv-r446

Published

2026-11-13T12:00:00Z

Modified

2026-11-13T12:45:06Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

KVStoreInterpreter::verify_signature_legacy answers true for every token and every key

Details

KVStoreInterpreter::verify_signature_legacy(&PushDrop, &PublicKey), public and deprecated since 0.2.0 (the crate's first release), read neither argument and answered true. A KVStore token signed by nobody, a signed token checked against a key other than its controller's, and a PushDrop with no fields each passed. Its documentation said it delegated to the KVStoreFields-based verifier; it did not.

An application that checks, with this function, a KVStore token it did not write (an overlay lookup's answer, or a transaction output a peer hands it) and acts on true accepts a value no controller signed, attributed to whatever controller the token names. No caller in the crate itself uses the function. This was run on 0.2.0, 0.5.0, 0.8.0, 0.8.7, 0.8.8, 0.9.0-beta.1 and 0.9.0-beta.7 as crates.io serves them, and the source of all 63 published versions carries the same constant body (the yanked 0.3.21 included).

0.8.9 answers true only for a token whose controller field is the given key and whose last field is that key's signature over the others (the 0.9 line's next prerelease carries the same fix). There is no workaround: upgrade to 0.8.9, or, on the 0.9 line, to its next prerelease.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / bsv-rs

Package

Name: bsv-rs; View open source insights on deps.dev
Purl: pkg:cargo/bsv-rs

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.8.9

Introduced

0.9.0-beta.1

Fixed

0.9.0-beta.7.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "bsv_rs::kvstore::KVStoreInterpreter::verify_signature_legacy"
        ],
        "os": []
    }
}