sebastienrousseau/libyml · Security
LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained
- GHSA ID
- GHSA-gfxp-f68g-8x78
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.
The GitHub project for libyml was archived after unsoundness issues were raised.
If you rely on this crate, it is highly recommended switching to a maintained alternative.
Recommended alternatives
libyaml-saferunsafe-libyaml-norway- Maintained fork ofunsafe-libyaml
CWEs
- CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior