Deps.rs

hstr 0.2.15

[![dependency status](https://deps.rs/crate/hstr/0.2.15/status.svg)](https://deps.rs/crate/hstr/0.2.15)

This project might be open to known security vulnerabilities, which can be prevented by tightening the version range of affected dependencies. Find detailed information at the bottom.

Crate hstr

Dependencies

(8 total, 4 outdated, 1 possibly insecure)

CrateRequiredLatestStatus
 hashbrown^0.14.30.16.1out of date
 new_debug_unreachable^1.0.41.0.6up to date
 once_cell^1.18.01.21.4up to date
 phf^0.11.20.13.1out of date
 rkyv ⚠️^0.7.420.8.15out of date
 rustc-hash^1.1.02.1.1out of date
 serde^1.0.1921.0.228up to date
 triomphe^0.1.110.1.15up to date

Dev dependencies

(10 total, 5 outdated)

CrateRequiredLatestStatus
 compact_str^0.7.10.9.0out of date
 criterion^0.5.10.8.2out of date
 dudy-malloc^0.1.00.1.2up to date
 kstring^2.0.02.0.2up to date
 num_cpus^1.16.01.17.0up to date
 rand^0.8.50.10.0out of date
 rayon^1.8.01.11.0up to date
 smartstring^1.0.11.0.1up to date
 smol_str^0.2.00.3.6out of date
 string_cache^0.8.70.9.0out of date

Security Vulnerabilities

rkyv: Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM

RUSTSEC-2026-0001

The SharedPointer::alloc implementation for sync::Arc<T> and rc::Rc<T> in rkyv/src/impls/alloc/rc/atomic.rs (and rc.rs) does not check if the allocator returns a null pointer on OOM (Out of Memory).

This null pointer can flow through to SharedPointer::from_value, which calls Box::from_raw(ptr) with the null pointer. This triggers undefined behavior when utilizing safe deserialization APIs (such as rkyv::from_bytes or rkyv::deserialize_using) if an OOM condition occurs during the allocation of the shared pointer.

The issue is reachable through safe code and violates Rust's safety guarantees.