{"id":"GHSA-2326-pfpj-vx3h","aliases":["RUSTSEC-2023-0086"],"status":"published","title":"lexical-core has multiple soundness issues","description":"`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-09-03T12:00:00Z","modified":"2026-09-10T03:50:55Z","fixes":[{"ecosystem":"crates.io","package":"lexical-core","fixed_in":["1.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"lexical-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lexical-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"lexical-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.0.0"}]}]}],"references":[{"url":"https://github.com/Alexhuszagh/rust-lexical/issues/101","tags":["web","report"]},{"url":"https://github.com/Alexhuszagh/rust-lexical/issues/102","tags":["web","report"]},{"url":"https://github.com/Alexhuszagh/rust-lexical/issues/104","tags":["web","report"]},{"url":"https://github.com/Alexhuszagh/rust-lexical/issues/126","tags":["web","report"]},{"url":"https://github.com/Alexhuszagh/rust-lexical/issues/95","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-c2hm-mjxv-89r4","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0055","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0086.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-2326-pfpj-vx3h"},{"url":"https://github.com/Alexhuszagh/rust-lexical","tags":["package"]},{"url":"https://crates.io/crates/lexical-core","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-2326-pfpj-vx3h","title":"lexical-core has multiple soundness issues","description":"`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.\n","status":"published","published":"2024-09-16T17:19:01Z","modified":"2024-09-16T17:19:02Z","updated_at":"2026-11-02T14:38:02.773864Z"}],"osv":[{"id":"GHSA-2326-pfpj-vx3h","title":"lexical-core has multiple soundness issues","description":"`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.\n","status":"published","published":"2024-09-16T17:19:01Z","modified":"2026-09-10T03:50:55.52940594Z","updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"RUSTSEC-2023-0086","title":"Multiple soundness issues","description":"`RUSTSEC-2024-0377` contains multiple soundness issues:\n\n 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)\n 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)\n 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)\n 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)\n 1. [`radix()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/126)\n\nVersion 1.0 fixes these issues, removes the vast majority of `unsafe` code, and also fixes some correctness issues.","status":"published","published":"2023-09-03T12:00:00Z","modified":"2026-02-04T03:49:11.161462Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}