GHSA-gfxp-f68g-8x78
LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained
GHSA-gfxp-f68g-8x78 is a high vulnerability (CVSS 8.7) in libyml, published September 11, 2025. No source lists public exploit code. No source names a fixed version.
- Severity
- 8.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Affected packages
What each source reports
GitHub Advisories Score used
LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
- Record
GHSA-gfxp-f68g-8x78- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-758
- Updated
- 2026-11-02
OSV
LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
- Record
GHSA-gfxp-f68g-8x78- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-758
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0067No score
`libyml::string::yaml_string_extend` is unsound and unmaintained
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
- Record
RUSTSEC-2025-0067- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.