RUSTSEC-2024-0449
unsafe-libyaml is unmaintained
The repository was archived by its owner on 2024-03-25 and is read-only. The last release is 0.2.11 (March 2024).
unsafe-libyaml is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
serde_yaml (itself deprecated) and by forks such as serde_yaml_ng.
Alternatives
Consider a YAML parser written in safe Rust, for example:
- saphyr (serde-saphyr for serde users)
- noyalib
What each source reports
OSV No score
unsafe-libyaml is unmaintained
The repository was archived by its owner on 2024-03-25 and is read-only. The last release is 0.2.11 (March 2024).
unsafe-libyaml is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
serde_yaml (itself deprecated) and by forks such as serde_yaml_ng.
Alternatives
Consider a YAML parser written in safe Rust, for example:
- saphyr (serde-saphyr for serde users)
- noyalib
- Record
RUSTSEC-2024-0449- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
unsafe-libyamlcrates.io |
0.0.0-0 and later | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2024-0449 is a vulnerability with no CVSS score yet in unsafe-libyaml, published March 25, 2024. No source lists public exploit code. No source names a fixed version.