Deps.rs

generic-array 1.4.2

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate generic-array

Dependencies

(15 total, 1 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 arbitrary^11.4.2up to date
 as-slice^0.20.2.1up to date
 bitvec^11.0.1up to date
 bytecheck^0.80.8.2up to date
 bytemuck^11.25.0up to date
 const-default^11.0.0up to date
 faster-hex^0.100.10.0up to date
 generic-array^0.141.4.2out of date
 hybrid-array^0.40.4.12up to date
 rkyv ⚠️^0.80.8.16maybe insecure
 rustversion^11.0.22up to date
 serde_core^1.01.0.228up to date
 subtle^22.6.1up to date
 typenum^1.191.20.1up to date
 zeroize^11.8.2up to date

Dev dependencies

(7 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 aes^0.8.40.9.1out of date
 bincode^1.03.0.0out of date
 bytecheck^0.80.8.2up to date
 criterion^0.50.8.2out of date
 rand^0.90.10.1out of date
 rkyv ⚠️^0.80.8.16maybe insecure
 serde_json^1.01.0.150up to date

Security Vulnerabilities

rkyv: Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM

RUSTSEC-2026-0001

The SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).

This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.

The issue is reachable through safe code and violates Rust's safety guarantees.