{"id":"GHSA-5w5r-mf82-595p","aliases":["RUSTSEC-2025-0143"],"status":"published","title":"Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema","description":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(\u0026self) -\u003e Result\u003c\u003cT as Owned\u003e::Reader\u003c'static\u003e\u003e {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -\u003e StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-758"],"published":"2025-12-24T12:00:00Z","modified":"2026-02-03T03:06:53Z","fixes":[{"ecosystem":"crates.io","package":"capnp","fixed_in":["0.24.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"capnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"capnp","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.24.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"capnp","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.24.0"}]}]}],"references":[{"url":"https://github.com/capnproto/capnproto-rust/issues/605","tags":["web","report"]},{"url":"https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf","tags":["web"]},{"url":"https://github.com/capnproto/capnproto-rust/commit/e3aeec213e6d1b30a182bf61682a370f20d8a02c","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0143.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5w5r-mf82-595p"},{"url":"https://github.com/capnproto/capnproto-rust","tags":["package"]},{"url":"https://crates.io/crates/capnp","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-5w5r-mf82-595p","title":"Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema","description":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(\u0026self) -\u003e Result\u003c\u003cT as Owned\u003e::Reader\u003c'static\u003e\u003e {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -\u003e StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","status":"published","published":"2026-01-28T16:06:09Z","modified":"2026-01-28T16:06:09Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-758"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"osv":[{"id":"GHSA-5w5r-mf82-595p","title":"Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema","description":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(\u0026self) -\u003e Result\u003c\u003cT as Owned\u003e::Reader\u003c'static\u003e\u003e {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -\u003e StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","status":"published","published":"2026-01-28T16:06:09Z","modified":"2026-02-03T03:06:53.944791Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-758"],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"RUSTSEC-2025-0143","title":"Unsound APIs of public `constant::Reader` and `StructSchema`","description":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(\u0026self) -\u003e Result\u003c\u003cT as Owned\u003e::Reader\u003c'static\u003e\u003e {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -\u003e StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","status":"published","published":"2025-12-24T12:00:00Z","modified":"2026-01-29T06:11:15.85462Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}