gz/rust-cpuid · Security
Optional `Deserialize` implementations lacking validation
- GHSA ID
- GHSA-jf5h-cf95-w759
- Severity
- medium
- Published
- Updated
Description
When activating the non-default feature serialize, most structs implement
serde::Deserialize without sufficient validation. This allows breaking
invariants in safe code, leading to:
- Undefined behavior in
as_string()methods (which usestd::str::from_utf8_unchecked()internally). - Panics due to failed assertions.