GHSA-rcx8-48pc-v9q8
mail-internals use-after-free vulnerability in `vec_insert_bytes`
Incorrect reallocation logic in the function vec_insert_bytes causes a use-after-free.
This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally.
The mail-* suite is unmaintained and the upstream sources have been actively vandalised.
A fixed mail-internals-ng (and mail-headers-ng and mail-core-ng) crate has been published which fixes this, and a dependency on another unsound crate.
What each source reports
GitHub AdvisoriesNo score
mail-internals use-after-free vulnerability in `vec_insert_bytes`
Incorrect reallocation logic in the function vec_insert_bytes causes a use-after-free.
This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally.
The mail-* suite is unmaintained and the upstream sources have been actively vandalised.
A fixed mail-internals-ng (and mail-headers-ng and mail-core-ng) crate has been published which fixes this, and a dependency on another unsound crate.
- Record
GHSA-rcx8-48pc-v9q8- Updated
- 2026-11-02
OSVNo score
mail-internals use-after-free vulnerability in `vec_insert_bytes`
Incorrect reallocation logic in the function vec_insert_bytes causes a use-after-free.
This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally.
The mail-* suite is unmaintained and the upstream sources have been actively vandalised.
A fixed mail-internals-ng (and mail-headers-ng and mail-core-ng) crate has been published which fixes this, and a dependency on another unsound crate.
- Record
GHSA-rcx8-48pc-v9q8- Updated
- 2026-11-02
OSVRUSTSEC-2023-0054No score
Use-after-free in `vec_insert_bytes`
Incorrect reallocation logic in the function vec_insert_bytes causes a use-after-free.
This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally.
The mail-* suite is unmaintained and the upstream sources have been actively vandalised.
A fixed mail-internals-ng (and mail-headers-ng and mail-core-ng) crate has been published which fixes this, and a dependency on another unsound crate.
- Record
RUSTSEC-2023-0054- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mail-internalscrates.io | 0.2.0 to 0.2.3 | None known |
mail-internalscrates.io | 0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-rcx8-48pc-v9q8 is a vulnerability with no CVSS score yet in mail-internals, published August 7, 2023. No source lists public exploit code. No source names a fixed version.