{"id":"GHSA-9fm9-c4h4-8g93","aliases":["RUSTSEC-2026-0452"],"status":"published","title":"Out-of-bounds read when decoding internal keys shorter than 16 bytes","description":"`InternalKeyRef::from_encoded` is a safe constructor whose only length check is `debug_assert!(encoded.len() \u003e= 16)`, which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: `user_key()` slices `\u0026encoded[..len - 16]`, `trailer()`/`seq_num()` pass `len - 16` and `timestamp()` passes `len - 8` to `read_u64_be`, which computes `buffer.as_ptr().add(offset)` and performs an 8-byte load. For a short slice the subtraction underflows `usize`, the pointer wraps below the allocation and eight bytes before the buffer are read (undefined behavior; confirmed with AddressSanitizer as a `heap-buffer-overflow`). In debug builds the same call panics instead.\n\nThe same invariant is missing at the on-disk decode boundary: `BlockIterator::seek_next_entry` rebuilds the current key from block bytes with upper-bound checks only, and `BlockIterator::key()` wraps it in `InternalKeyRef`, which `surrealdb`'s `kv-surrealkv` backend then reads through `key_ref.timestamp()`. A crafted or corrupted SSTable therefore reaches the same unchecked subtraction without any `unsafe` at the call site.\n\n`1.2.0` rejects internal keys shorter than their 8-byte trailer before any accessor computes an offset and makes the accessors bounds-checked (fix in commit `ac642f9`, `surrealdb` 4.0.0 ships `surrealkv` 1.2.0).","severity":{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-03T12:00:00Z","modified":"2026-11-06T15:45:02Z","fixes":[{"ecosystem":"crates.io","package":"surrealkv","fixed_in":["1.2.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"surrealkv","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.2.0"}]}]}],"references":[{"url":"https://crates.io/crates/surrealkv","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0452.html","tags":["advisory"]},{"url":"https://github.com/surrealdb/surrealkv/commit/ac642f945d63c9c9f7ad35f480995fd516f83fb6","tags":["web"]},{"url":"https://github.com/surrealdb/surrealkv/pull/497","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0452","title":"Out-of-bounds read when decoding internal keys shorter than 16 bytes","description":"`InternalKeyRef::from_encoded` is a safe constructor whose only length check is `debug_assert!(encoded.len() \u003e= 16)`, which is compiled out in release builds. Its accessors perform unchecked length arithmetic on the slice: `user_key()` slices `\u0026encoded[..len - 16]`, `trailer()`/`seq_num()` pass `len - 16` and `timestamp()` passes `len - 8` to `read_u64_be`, which computes `buffer.as_ptr().add(offset)` and performs an 8-byte load. For a short slice the subtraction underflows `usize`, the pointer wraps below the allocation and eight bytes before the buffer are read (undefined behavior; confirmed with AddressSanitizer as a `heap-buffer-overflow`). In debug builds the same call panics instead.\n\nThe same invariant is missing at the on-disk decode boundary: `BlockIterator::seek_next_entry` rebuilds the current key from block bytes with upper-bound checks only, and `BlockIterator::key()` wraps it in `InternalKeyRef`, which `surrealdb`'s `kv-surrealkv` backend then reads through `key_ref.timestamp()`. A crafted or corrupted SSTable therefore reaches the same unchecked subtraction without any `unsafe` at the call site.\n\n`1.2.0` rejects internal keys shorter than their 8-byte trailer before any accessor computes an offset and makes the accessors bounds-checked (fix in commit `ac642f9`, `surrealdb` 4.0.0 ships `surrealkv` 1.2.0).","status":"published","published":"2026-11-03T12:00:00Z","modified":"2026-11-06T15:45:02.399716444Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-06T15:57:48.551562Z"}]}}