All vulnerabilities
GHSA-6g2r-675j-hx59

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

xxhash-rustrustLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.8.16Fixed versionGitHub
Published2 Oct 2026Updated 2 Oct 2026GitHub

What fixes it

  • 0.8.16xxhash-rust, rustGitHub
  • 0.8.16xxhash-rust, crates.ioOSVcargo update -p xxhash-rust --precise 0.8.16

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

I have a minimized safe Rust witness for xxhash-rust 0.8.15.

Safe public route:

xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])

The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.

Observed diagnostic:

Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference

Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.

Local artifacts:

  • vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
  • repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
  • report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md

Text from GitHub Advisory Database

Affected versions 2

  • xxhash-rust, rust< 0.8.16GitHub
  • xxhash-rust, crates.iofrom first release, fixed in 0.8.16OSV

References 3