{"schema_version":"2","view":"grouped","data":[{"id":70968,"cve_ids":[],"payload":{"kind":"advisory","title":"xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release","summary":"I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[]) The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation. Observed diagnostic: Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri. Local artifacts: - vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log - repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log - report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md","evidence":"osv:GHSA-6g2r-675j-hx59","products":[{"name":{"value":"xxhash-rust","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"GHSA-6g2r-675j-hx59","aliases":["GHSA-6g2r-675j-hx59"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.16"}]}],"package":{"name":"xxhash-rust","purl":"pkg:cargo/xxhash-rust","ecosystem":"crates.io"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6g2r-675j-hx59/GHSA-6g2r-675j-hx59.json"}}],"modified":"2026-10-02T18:45:04.881140605Z","provider":"osv","references":["https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59","https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200","https://github.com/DoumanAsh/xxhash-rust"],"provider_metadata":{"cwe_ids":["CWE-125"],"severity":"LOW","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-10-02T18:29:13Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-6g2r-675j-hx59","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59","advisory_id":"c0a04a3f-0eb8-4eea-8bea-a71fe1ab7574","event_types":["advisory"],"published_at":"2026-10-25T22:45:54.300239+00:00","technologies":["core-osv","xxhash-rust"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T18:29:13+00:00","detail_url":"/advisories/osv%3AGHSA-6g2r-675j-hx59","group":{"id":"osv:GHSA-6g2r-675j-hx59","revision":1,"primary_event_id":71341,"change":"published","superseded_by":[],"changed":{"id":71341,"cve_ids":[],"payload":{"kind":"advisory","title":"xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release","summary":"I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[]) The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation. Observed diagnostic: Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri. Local artifacts: - vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log - repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log - report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md","evidence":"osv:GHSA-6g2r-675j-hx59","products":[{"name":{"value":"xxhash-rust","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"GHSA-6g2r-675j-hx59","aliases":["GHSA-6g2r-675j-hx59"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.16"}]}],"package":{"name":"xxhash-rust","purl":"pkg:cargo/xxhash-rust","ecosystem":"crates.io"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6g2r-675j-hx59/GHSA-6g2r-675j-hx59.json"}}],"modified":"2026-10-02T18:45:04.881140605Z","provider":"osv","references":["https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59","https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200","https://github.com/DoumanAsh/xxhash-rust"],"provider_metadata":{"cwe_ids":["CWE-125"],"severity":"LOW","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-10-02T18:29:13Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-6g2r-675j-hx59","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59","advisory_id":"c0a04a3f-0eb8-4eea-8bea-a71fe1ab7574","event_types":["advisory"],"published_at":"2026-10-25T22:45:54.300239+00:00","technologies":["core-osv","xxhash-rust"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T18:29:13+00:00","detail_url":"/events/71341"},"members":[{"id":71341,"cve_ids":[],"payload":{"kind":"advisory","title":"xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release","summary":"I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[]) The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation. Observed diagnostic: Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri. Local artifacts: - vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log - repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log - report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md","evidence":"osv:GHSA-6g2r-675j-hx59","products":[{"name":{"value":"xxhash-rust","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.16","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"low","structured":{"id":"GHSA-6g2r-675j-hx59","aliases":["GHSA-6g2r-675j-hx59"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.16"}]}],"package":{"name":"xxhash-rust","purl":"pkg:cargo/xxhash-rust","ecosystem":"crates.io"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-6g2r-675j-hx59/GHSA-6g2r-675j-hx59.json"}}],"modified":"2026-10-02T18:45:04.881140605Z","provider":"osv","references":["https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59","https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200","https://github.com/DoumanAsh/xxhash-rust"],"provider_metadata":{"cwe_ids":["CWE-125"],"severity":"LOW","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-10-02T18:29:13Z"}},"related_cves":[],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-6g2r-675j-hx59","priority":{"reasons":[],"severity":"low","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"low"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59","advisory_id":"c0a04a3f-0eb8-4eea-8bea-a71fe1ab7574","event_types":["advisory"],"published_at":"2026-10-25T22:45:54.300239+00:00","technologies":["core-osv","xxhash-rust"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T18:29:13+00:00","detail_url":"/events/71341"}]}}],"next_after":70968,"next_before":70968}