GHSA-ghc8-5cgm-5rpf
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main.
If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are likely; UB is possible.
The flaw was corrected by enforcing that only code written within the inventory crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before main. Caller-provided code is restricted to running at compile time.
What each source reports
GitHub AdvisoriesNo score
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main.
If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are likely; UB is possible.
The flaw was corrected by enforcing that only code written within the inventory crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before main. Caller-provided code is restricted to running at compile time.
- Record
GHSA-ghc8-5cgm-5rpf- Updated
- 2026-11-02
OSVNo score
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the lifetime of main.
If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as std::io or std::thread, these may not behave as documented. Panics are likely; UB is possible.
The flaw was corrected by enforcing that only code written within the inventory crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before main. Caller-provided code is restricted to running at compile time.
- Record
GHSA-ghc8-5cgm-5rpf- Updated
- 2026-11-02
OSVRUSTSEC-2023-0057No score
Fails to prohibit standard library access prior to initialization of Rust standard library runtime
Affected versions allow arbitrary caller-provided code to execute before the
lifetime of main.
If the caller-provided code accesses particular pieces of the standard library
that require an initialized Rust runtime, such as std::io or std::thread,
these may not behave as documented. Panics are likely; UB is possible.
The flaw was corrected by enforcing that only code written within the
inventory crate, which is guaranteed not to access runtime-dependent parts of
the standard library, runs before main. Caller-provided code is restricted to
running at compile time.
- Record
RUSTSEC-2023-0057- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-ghc8-5cgm-5rpf is a vulnerability with no CVSS score yet in inventory, published September 10, 2023. No source lists public exploit code. Fixed in inventory 0.2.0.