GHSA-4xcc-23fx-w2wj
Resource budgets not enforced on the typed deserialization path
ParserConfig::max_events, max_nodes, max_total_scalar_bytes,
max_merge_keys, alias_anchor_ratio and the alias jump factor were
enforced only by the two Value loaders. A typed target with a
default-shaped configuration is served by the streaming deserializer,
which never read those fields, so tightening any of them had no effect
on from_str::<T> for a struct target. The default document-length,
depth and alias-count caps were enforced on every path, so no input was
unbounded; the gap affects callers who tightened the other budgets for
hostile input.
Version 0.0.53 charges every budget on the streaming path as well and adds cross-path parity tests.
Users who cannot upgrade can deserialize into noyalib::Value first and
convert with from_value, or rely on max_document_length and
max_depth, which were always applied on every path.
What each source reports
OSVRUSTSEC-2026-0333No score
Resource budgets not enforced on the typed deserialization path
ParserConfig::max_events, max_nodes, max_total_scalar_bytes,
max_merge_keys, alias_anchor_ratio and the alias jump factor were
enforced only by the two Value loaders. A typed target with a
default-shaped configuration is served by the streaming deserializer,
which never read those fields, so tightening any of them had no effect
on from_str::<T> for a struct target. The default document-length,
depth and alias-count caps were enforced on every path, so no input was
unbounded; the gap affects callers who tightened the other budgets for
hostile input.
Version 0.0.53 charges every budget on the streaming path as well and adds cross-path parity tests.
Users who cannot upgrade can deserialize into noyalib::Value first and
convert with from_value, or rely on max_document_length and
max_depth, which were always applied on every path.
- Record
RUSTSEC-2026-0333- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
noyalibcrates.io | 0.0.0-0 up to 0.0.53 | 0.0.53 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-4xcc-23fx-w2wj is a vulnerability with no CVSS score yet in noyalib, published October 6, 2026. No source lists public exploit code. Fixed in noyalib 0.0.53.