GHSA-5x36-7567-3cw6
partial_sort contains Out-of-bounds Read in release mode
Affected versions of this crate were using a debug assertion to validate the last parameter of partial_sort(). This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.
All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.
The accessible region is further limited by an initial bounds-checked read at (last / 2) - 1, i.e., it is proportional to the size of the vector.
This bug has been fixed in v0.2.0.
What each source reports
GitHub AdvisoriesNo score
partial_sort contains Out-of-bounds Read in release mode
Affected versions of this crate were using a debug assertion to validate the last parameter of partial_sort(). This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.
All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.
The accessible region is further limited by an initial bounds-checked read at (last / 2) - 1, i.e., it is proportional to the size of the vector.
This bug has been fixed in v0.2.0.
- Record
GHSA-5x36-7567-3cw6- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVNo score
partial_sort contains Out-of-bounds Read in release mode
Affected versions of this crate were using a debug assertion to validate the last parameter of partial_sort(). This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.
All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.
The accessible region is further limited by an initial bounds-checked read at (last / 2) - 1, i.e., it is proportional to the size of the vector.
This bug has been fixed in v0.2.0.
- Record
GHSA-5x36-7567-3cw6- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRUSTSEC-2023-0016No score
Possible out-of-bounds read in release mode
Affected versions of this crate were using a debug assertion to validate the
last parameter of partial_sort(). This would allow invalid inputs to cause
an out-of-bounds read instead of immediately panicking, when compiled without
debug assertions.
All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.
The accessible region is further limited by an initial bounds-checked read
at (last / 2) - 1, i.e., it is proportional to the size of the vector.
This bug has been fixed in v0.2.0.
- Record
RUSTSEC-2023-0016- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
partial_sortcrates.io | before 0.2.0 | 0.2.0 |
partial_sortcrates.io | 0.0.0-0 up to 0.2.0 | 0.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-5x36-7567-3cw6 is a vulnerability with no CVSS score yet in partial_sort, published February 20, 2023. No source lists public exploit code. Fixed in partial_sort 0.2.0.