{"id":"RUSTSEC-2026-0130","aliases":[],"status":"published","title":"Out-of-bounds read/write in `Index` and `IndexMut` implementations","description":"The `Index` and `IndexMut` implementations for `Caja` use unchecked pointer\narithmetic without bounds validation. Creating a `Caja` with a small key and\nthen accessing an out-of-range index causes out-of-bounds reads or writes\nbeyond the allocated memory.\n\nThis can be triggered through safe public APIs — the `[]` indexing operator\non a `Caja` with an out-of-range index — with no `unsafe` required from the\ncaller.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-05-02T12:00:00Z","modified":"2026-05-13T12:45:08Z","fixes":[{"ecosystem":"crates.io","package":"caja","fixed_in":["0.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"caja","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.0"}]}]}],"references":[{"url":"https://crates.io/crates/caja","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0130.html","tags":["advisory"]},{"url":"https://github.com/EmanuelGCC/Caja/issues/1","tags":["report"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0130","title":"Out-of-bounds read/write in `Index` and `IndexMut` implementations","description":"The `Index` and `IndexMut` implementations for `Caja` use unchecked pointer\narithmetic without bounds validation. Creating a `Caja` with a small key and\nthen accessing an out-of-range index causes out-of-bounds reads or writes\nbeyond the allocated memory.\n\nThis can be triggered through safe public APIs — the `[]` indexing operator\non a `Caja` with an out-of-range index — with no `unsafe` required from the\ncaller.","status":"published","published":"2026-05-02T12:00:00Z","modified":"2026-05-13T12:45:08.933263Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}