{"id":"GHSA-255r-3prx-mf99","aliases":["RUSTSEC-2022-0092"],"status":"published","title":"`rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8","description":"It was found that `Raw::from_utf8` expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-04-13T12:00:00Z","modified":"2026-09-10T03:49:52Z","fixes":[{"ecosystem":"crates.io","package":"rmp-serde","fixed_in":["1.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rmp-serde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rmp-serde","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rmp-serde","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.1.1"}]}]}],"references":[{"url":"https://github.com/3Hren/msgpack-rust/issues/305","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0092.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-255r-3prx-mf99"},{"url":"https://github.com/3Hren/msgpack-rust","tags":["package"]},{"url":"https://crates.io/crates/rmp-serde","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-255r-3prx-mf99","title":"`rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8","description":"It was found that `Raw::from_utf8` expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash.\n","status":"published","published":"2023-03-22T22:21:49Z","modified":"2023-03-22T22:21:50Z","updated_at":"2026-11-02T14:36:48.041653Z"}],"osv":[{"id":"GHSA-255r-3prx-mf99","title":"`rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8","description":"It was found that `Raw::from_utf8` expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash.\n","status":"published","published":"2023-03-22T22:21:49Z","modified":"2026-09-10T03:49:52.279812339Z","updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"RUSTSEC-2022-0092","title":"`rmp-serde` `Raw` and `RawRef` unsound","description":"It was found that `Raw::from_utf8` expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash.","status":"published","published":"2022-04-13T12:00:00Z","modified":"2023-11-08T04:13:53.714604Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}