Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    RUSTSEC-2026-0294 (GHSA-8MQ4-3MWQ-QVG6)

    Vulnerability from osv_rustsec – Published: 2026-09-18 12:00 – Updated: 2026-09-21 09:29 – Source website
    VLAI
    Summary
    Unsoundness in UTF-8 'String' trait
    Details

    The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.

    The API methods as_mut_bytes and deref_mut where removed from the String API and their implementations (PolymorphicString, RelocatableString, and StaticString ) without replacement. Link to Pull-Request: https://github.com/eclipse-iceoryx/iceoryx2/pull/1956

    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": null,
        "informational": "unsound"
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "iceoryx2_bb_container::string::String::as_mut_bytes",
            "iceoryx2_bb_container::string::String::deref_mut",
            "iceoryx2_bb_container::string::polymorphic_string::PolymorphicString::as_mut_bytes",
            "iceoryx2_bb_container::string::polymorphic_string::PolymorphicString::deref_mut",
            "iceoryx2_bb_container::string::relocatable_string::RelocatableString::as_mut_bytes",
            "iceoryx2_bb_container::string::relocatable_string::RelocatableString::deref_mut",
            "iceoryx2_bb_container::string::static_string::StaticString::as_mut_bytes",
            "iceoryx2_bb_container::string::static_string::StaticString::deref_mut"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "iceoryx2-bb-container",
        "purl": "pkg:cargo/iceoryx2-bb-container"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.10.0"
            },
            {
              "introduced": "0.11.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-8mq4-3mwq-qvg6"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. \nAn application can therefore create an invalid \u0026str and trigger undefined behavior using entirely safe Rust.\n\nThe API methods `as_mut_bytes` and `deref_mut` where removed from the String API and their implementations (PolymorphicString, RelocatableString, and StaticString ) without replacement.\nLink to Pull-Request: https://github.com/eclipse-iceoryx/iceoryx2/pull/1956",
  "id": "RUSTSEC-2026-0294",
  "modified": "2026-09-21T09:29:57Z",
  "published": "2026-09-18T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/iceoryx2-bb-container"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0294.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eclipse-iceoryx/iceoryx2/pull/1956"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Unsoundness in UTF-8 \u0027String\u0027 trait"
}