{"id":"GHSA-3jch-9qgp-4844","aliases":["RUSTSEC-2021-0122"],"status":"published","title":"Generated code can read and write out of bounds in safe code","description":"Code generated by flatbuffers' compiler is `unsafe` but not marked as such.\nSee https://github.com/google/flatbuffers/issues/6627 for details.\n\nAll users that use generated code by `flatbuffers` compiler are recommended to:\n1. not expose flatbuffer generated code as part of their public APIs\n2. audit their code and look for any usage of `follow`, `push`, or any method that uses them\n   (e.g. `self_follow`).\n3. Carefuly go through the crates' documentation to understand which \"safe\" APIs are not\n   intended to be used.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-10-31T12:00:00Z","modified":"2023-11-08T04:14:40Z","fixes":[{"ecosystem":"crates.io","package":"flatbuffers","fixed_in":["22.9.29"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"flatbuffers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.9.29"}]}]},{"source":"osv","ecosystem":"crates.io","package":"flatbuffers","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.9.29"}]}]},{"source":"osv","ecosystem":"crates.io","package":"flatbuffers","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"22.9.29"}]}]}],"references":[{"url":"https://github.com/google/flatbuffers/issues/6627","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0122.html","tags":["web","advisory"]},{"url":"https://github.com/google/flatbuffers/pull/7518","tags":["web"]},{"url":"https://github.com/google/flatbuffers/releases/tag/v22.9.29","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3jch-9qgp-4844"},{"url":"https://github.com/google/flatbuffers","tags":["package"]},{"url":"https://crates.io/crates/flatbuffers","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3jch-9qgp-4844","title":"Generated code can read and write out of bounds in safe code","description":"Code generated by flatbuffers' compiler is `unsafe` but not marked as such.\nSee https://github.com/google/flatbuffers/issues/6627 for details.\n\nAll users that use generated code by `flatbuffers` compiler are recommended to:\n1. not expose flatbuffer generated code as part of their public APIs\n2. audit their code and look for any usage of `follow`, `push`, or any method that uses them\n   (e.g. `self_follow`).\n3. Carefuly go through the crates' documentation to understand which \"safe\" APIs are not\n   intended to be used.\n","status":"published","published":"2022-06-16T23:54:35Z","modified":"2023-01-08T05:06:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-3jch-9qgp-4844","title":"Generated code can read and write out of bounds in safe code","description":"Code generated by flatbuffers' compiler is `unsafe` but not marked as such.\nSee https://github.com/google/flatbuffers/issues/6627 for details.\n\nAll users that use generated code by `flatbuffers` compiler are recommended to:\n1. not expose flatbuffer generated code as part of their public APIs\n2. audit their code and look for any usage of `follow`, `push`, or any method that uses them\n   (e.g. `self_follow`).\n3. Carefuly go through the crates' documentation to understand which \"safe\" APIs are not\n   intended to be used.\n","status":"published","published":"2022-06-16T23:54:35Z","modified":"2023-11-08T04:14:40.953991Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RUSTSEC-2021-0122","title":"Generated code can read and write out of bounds in safe code","description":"Code generated by flatbuffers' compiler is `unsafe` but not marked as such.\nSee https://github.com/google/flatbuffers/issues/6627 for details.\n\nFor example, if generated code is used to decode malformed or untrusted input,\nundefined behavior (and thus security vulnerabilities) is possible even without\nthe use of the `unsafe` keyword, [violating the the meaning of \"safe\"](https://doc.rust-lang.org/std/keyword.unsafe.html#the-different-meanings-of-unsafe) code;\n\nAll users that use generated code by `flatbuffers` compiler are recommended to:\n1. not expose flatbuffer generated code as part of their public APIs\n2. audit their code and look for any usage of `follow`, `push`, or any method that uses them\n   (e.g. `self_follow`).\n3. Carefully go through the crates' documentation to understand which \"safe\" APIs are not\n   intended to be used.","status":"published","published":"2021-10-31T12:00:00Z","modified":"2023-11-08T04:14:40.953991Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}