RUSTSEC-2024-0448
`parse_arguments` reads a caller-supplied pointer as a slice
parse_arguments is safe. It takes arguments: *const AnyObject and argc, and calls slice::from_raw_parts(arguments, argc as usize).
It does not check that arguments is non-null and aligned, or that argc elements are initialized. Safe Rust can pass a null pointer or a length past the allocation. The maintainer confirmed this on 2026-10-03, including a debug abort on Rust 1.78+ when Ruby calls an arity -1 method (to_s via format, puts, or Array#join) with a NULL argv and argc of 0.
What each source reports
OSV No score
`parse_arguments` reads a caller-supplied pointer as a slice
parse_arguments is safe. It takes arguments: *const AnyObject and argc, and calls slice::from_raw_parts(arguments, argc as usize).
It does not check that arguments is non-null and aligned, or that argc elements are initialized. Safe Rust can pass a null pointer or a length past the allocation. The maintainer confirmed this on 2026-10-03, including a debug abort on Rust 1.78+ when Ruby calls an arity -1 method (to_s via format, puts, or Array#join) with a NULL argv and argc of 0.
- Record
RUSTSEC-2024-0448- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rutiecrates.io |
0.0.0-0 up to 0.10.3, 0.11.0 up to 0.11.3, 0.12.0 up to 0.12.1, 0.13.0 up to 0.13.1, 0.14.0 up to 0.14.1 | 0.10.30.11.30.12.10.13.10.14.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2024-0448 is a vulnerability with no CVSS score yet in rutie, published November 25, 2024. No source lists public exploit code. Fixed in rutie 0.10.3.