{"id":"GHSA-pfr9-2p92-qrhq","aliases":["RUSTSEC-2024-0377"],"status":"published","title":"Databento Binary Encoding (DBN) has a heap buffer overflow using c_chars_to_str function","description":"The `heap-buffer-overflow` is triggered in the `strlen()` function when handling the `c_chars_to_str` function in the dbn crate. This vulnerability occurs because the `CStr::from_ptr()` function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.\n\nIf the chars array does not contain a null byte (\\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-126"],"published":"2024-10-07T12:00:00Z","modified":"2026-05-20T01:00:15Z","fixes":[{"ecosystem":"crates.io","package":"dbn","fixed_in":["0.22.1","0.22.1-0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"dbn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.22.0"},{"fixed":"0.22.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"dbn","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"dbn","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.22.1-0"}]}]}],"references":[{"url":"https://github.com/databento/dbn/issues/67","tags":["web","report"]},{"url":"https://github.com/databento/dbn/commit/339efb90fdb980920a5e8829008abc1114f4bfdd","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0377.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pfr9-2p92-qrhq"},{"url":"https://github.com/databento/dbn","tags":["package"]},{"url":"https://crates.io/crates/dbn","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-pfr9-2p92-qrhq","title":"Databento Binary Encoding (DBN) has a heap buffer overflow using c_chars_to_str function","description":"The `heap-buffer-overflow` is triggered in the `strlen()` function when handling the `c_chars_to_str` function in the dbn crate. This vulnerability occurs because the `CStr::from_ptr()` function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.\n\nIf the chars array does not contain a null byte (\\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.","status":"published","published":"2024-10-09T14:34:24Z","modified":"2026-05-20T00:56:58Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"osv":[{"id":"GHSA-pfr9-2p92-qrhq","title":"Databento Binary Encoding (DBN) has a heap buffer overflow using c_chars_to_str function","description":"The `heap-buffer-overflow` is triggered in the `strlen()` function when handling the `c_chars_to_str` function in the dbn crate. This vulnerability occurs because the `CStr::from_ptr()` function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.\n\nIf the chars array does not contain a null byte (\\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.","status":"published","published":"2024-10-09T14:34:24Z","modified":"2026-05-20T01:00:15.746612546Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RUSTSEC-2024-0377","title":"Heap Buffer overflow using c_chars_to_str function","description":"The `heap-buffer-overflow` is triggered in the `strlen()` function when handling the `c_chars_to_str` function in the dbn crate. This vulnerability occurs because the `CStr::from_ptr()` function in Rust assumes that the provided C string is null-terminated. However, there is no guarantee that the input chars array passed to the c_chars_to_str function is properly null-terminated.\n\nIf the chars array does not contain a null byte (\\0), strlen() will continue to read beyond the bounds of the buffer in search of a null terminator. This results in an out-of-bounds memory read and can lead to a heap-buffer-overflow, potentially causing memory corruption or exposing sensitive information.","status":"published","published":"2024-10-07T12:00:00Z","modified":"2025-10-28T06:29:25.627925Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}