{"id":"CVE-2023-42447","aliases":["EUVD-2023-2491","GHSA-cxvp-82cq-57h2","RUSTSEC-2023-0083"],"status":"published","title":"blurhash panics on parsing crafted inputs","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00624,"percentile":0.50195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-248","CWE-392"],"published":"2023-09-19T12:00:00Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"crates.io","package":"blurhash","fixed_in":["0.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"blurhash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.1"},{"last_affected":"0.1.1"},{"fixed":"0.2.0"}]}],"versions":["0.1.1"]},{"source":"osv","ecosystem":"crates.io","package":"blurhash","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.1"},{"fixed":"0.2.0"}]}],"versions":["0.1.1"]},{"source":"osv","ecosystem":"crates.io","package":"blurhash","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.0"}]}]}],"products":[{"vendor":"whisperfish","product":"blurhash-rs"}],"references":[{"url":"https://github.com/whisperfish/blurhash-rs/security/advisories/GHSA-cxvp-82cq-57h2","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42447","tags":["advisory"]},{"url":"https://github.com/whisperfish/blurhash-rs/releases/tag/v0.2.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cxvp-82cq-57h2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42447.json","tags":["advisory"]},{"url":"https://github.com/whisperfish/blurhash-rs","tags":["package"]},{"url":"https://crates.io/crates/blurhash","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0083.html","tags":["advisory"]},{"url":"https://github.com/whisperfish/blurhash-rs/commit/e1b3209734d2a2704ed5ddcf61dc0beab6caa64d","tags":["web"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42447","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-42447","title":"blurhash panics on parsing crafted inputs","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","status":"published","published":"2023-09-19T14:57:16.784Z","modified":"2024-09-24T18:56:15.507Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248","CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-2491","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","status":"published","published":"2023-09-19T14:57:16Z","modified":"2024-09-24T18:56:15Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:14.929509Z"}],"ghsa":[{"id":"GHSA-cxvp-82cq-57h2","title":"blurhash panics on parsing crafted inputs","description":"### Impact\nThe blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.\n\nIn a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:\n- UTF-8 compliant strings containing multi-byte UTF-8 characters\n\n### Patches\nThe patches will be released under version 0.2.0, which requires user intervention because of slight API churn.\n\n### Workarounds\nn.a.\n\n### References\nn.a.\n","status":"published","published":"2023-09-21T17:10:22Z","modified":"2023-11-12T05:01:56Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:37:21.209096Z"}],"nvd":[{"id":"CVE-2023-42447","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","status":"published","published":"2023-09-19T15:15:57.27Z","modified":"2026-06-17T06:23:50.947Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-248","CWE-392","CWE-1284"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"CVE-2023-42447","title":"blurhash panics on parsing crafted inputs","description":"blurhash-rs is a pure Rust implementation of Blurhash, software for encoding images into ASCII strings that can be turned into a gradient of colors representing the original image. In version 0.1.1, the blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include UTF-8 compliant strings containing multi-byte UTF-8 characters. A patch is available in version 0.2.0, which requires user intervention because of slight API churn. No known workarounds are available.","status":"published","published":"2023-09-19T14:57:16.784Z","modified":"2026-10-28T02:30:54.10371021Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-248","CWE-392"],"updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"GHSA-cxvp-82cq-57h2","title":"blurhash panics on parsing crafted inputs","description":"### Impact\nThe blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.\n\nIn a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:\n- UTF-8 compliant strings containing multi-byte UTF-8 characters\n\n### Patches\nThe patches will be released under version 0.2.0, which requires user intervention because of slight API churn.\n\n### Workarounds\nn.a.\n\n### References\nn.a.\n","status":"published","published":"2023-09-21T17:10:22Z","modified":"2026-03-16T03:02:05.56786Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-392"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"RUSTSEC-2023-0083","title":"blurhash: panic on parsing crafted blurhash inputs","description":"## Impact\nThe blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.\n\nIn a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:\n- UTF-8 compliant strings containing multi-byte UTF-8 characters\n\n## Patches\nThe patches were released under version 0.2.0, which may require user intervention because of slight API churn.","status":"published","published":"2023-09-19T12:00:00Z","modified":"2026-10-13T15:15:50.817581277Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.971022Z"}]}}