GHSA-2c6h-4899-wjxr | rschleitzer/scaly Security vulnerabilities | GitStock

GHSA ID: GHSA-2c6h-4899-wjxr
Severity: high
Published: 2026-04-04T05:45:17Z
Updated: 2026-04-04T05:45:51Z
CVSS v4: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Description

Affected versions contain multiple safe APIs that can trigger undefined behavior:

Array<T>::index can perform an out-of-bounds read.
String::get_length can perform an out-of-bounds read.
String::append_character can perform an invalid write.
String::to_c_string can perform an out-of-bounds write.

These issues were reproduced against scaly 0.0.37 under Miri. The crate is unmaintained.

CWEs

CWE-125 · Out-of-bounds Read
CWE-787 · Out-of-bounds Write

References