GHSA-pqpw-89w5-82v5
`simd-json-derive` vulnerable to `MaybeUninit` misuse
GHSA-pqpw-89w5-82v5 is a medium vulnerability (CVSS 6.6) in simd-json-derive, published October 14, 2023. No source lists public exploit code. Fixed in simd-json-derive 0.12.0.
- Severity
- 6.6 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.12.0simd-json-derive +1 more
Description
An invalid use of MaybeUninit::uninit().assume_init() in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)
The version 0.12.0 removes this section of code, avoiding the use of MaybeUninit alltogether.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
simd-json-derivecrates.io | before 0.12.0 | 0.12.0 |
simd-json-derivecrates.io | 0.0.0-0 up to 0.12.0 | 0.12.0 |
What each source reports
GitHub Advisories Score used
`simd-json-derive` vulnerable to `MaybeUninit` misuse
An invalid use of MaybeUninit::uninit().assume_init() in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)
The version 0.12.0 removes this section of code, avoiding the use of MaybeUninit alltogether.
- Record
GHSA-pqpw-89w5-82v5- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
OSV
`simd-json-derive` vulnerable to `MaybeUninit` misuse
An invalid use of MaybeUninit::uninit().assume_init() in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)
The version 0.12.0 removes this section of code, avoiding the use of MaybeUninit alltogether.
- Record
GHSA-pqpw-89w5-82v5- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U - Updated
- 2026-11-02
OSVRUSTSEC-2023-0087No score
`MaybeUninit` misuse in `simd-json-derive`
An invalid use of MaybeUninit::uninit().assume_init() in simd-json-derive's derive macro can cause undefined behavior. The original code used MaybeUninit to avoid initialisation of the struct and then set the fields using ptr::write. The undefined behavior triggered by this misuse of MaybeUninit can lead to invlaid memory access and panics in binaries compiled in release mode (aka simd-json-derive prior to version 0.12 has UB and optimizes into some nonsense)
The 0.12.0 removes this section of code, avoiding the use of MaybeUninit alltogether.
- Record
RUSTSEC-2023-0087- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.