CVE-2020-35918
Unexpected panic when decoding tokens in branca
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
- Record
CVE-2020-35918- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
- Record
CVE-2020-35918- Updated
- 2026-11-02
EUVDEUVD-2021-1678 No score
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
- Record
EUVD-2021-1678- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c9rv-3jmq-527w
Unexpected panic when decoding tokens in branca
Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding. The documentation stated that an error should have been reported instead.
- Record
GHSA-c9rv-3jmq-527w- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
- Record
CVE-2020-35918- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-c9rv-3jmq-527w
Unexpected panic when decoding tokens in branca
Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding. The documentation stated that an error should have been reported instead.
- Record
GHSA-c9rv-3jmq-527w- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0075
Unexpected panic when decoding tokens
Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly,
by supplying tokens with an incorrect base62 encoding.
The documentation stated that an error should have been reported instead.
- Record
RUSTSEC-2020-0075- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35918 is a medium vulnerability (CVSS 5.5) in Hakobaito Branca, published November 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in branca 0.10.0.
References
rustsec.org/advisories/RUSTSEC-2020-0075.html
github.com/tuupola/branca-spec/issues/22
nvd.nist.gov/vuln/detail/CVE-2020-35918
crates.io/crates/branca