RUSTSEC-2026-0333 (GHSA-4XCC-23FX-W2WJ)

Vulnerability from osv_rustsec – Published: 2026-10-06 12:00 – Updated: 2026-10-08 14:47 – Source website
VLAI
Summary
Resource budgets not enforced on the typed deserialization path
Details

ParserConfig::max_events, max_nodes, max_total_scalar_bytes, max_merge_keys, alias_anchor_ratio and the alias jump factor were enforced only by the two Value loaders. A typed target with a default-shaped configuration is served by the streaming deserializer, which never read those fields, so tightening any of them had no effect on from_str::<T> for a struct target. The default document-length, depth and alias-count caps were enforced on every path, so no input was unbounded; the gap affects callers who tightened the other budgets for hostile input.

Version 0.0.53 charges every budget on the streaming path as well and adds cross-path parity tests.

Users who cannot upgrade can deserialize into noyalib::Value first and convert with from_value, or rely on max_document_length and max_depth, which were always applied on every path.

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [
          "denial-of-service"
        ],
        "cvss": null,
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [
            "noyalib::from_reader",
            "noyalib::from_reader_with_config",
            "noyalib::from_slice",
            "noyalib::from_slice_with_config",
            "noyalib::from_str",
            "noyalib::from_str_with_config"
          ],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "noyalib",
        "purl": "pkg:cargo/noyalib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            },
            {
              "fixed": "0.0.53"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "GHSA-4xcc-23fx-w2wj"
  ],
  "database_specific": {
    "license": "CC-BY-4.0"
  },
  "details": "`ParserConfig::max_events`, `max_nodes`, `max_total_scalar_bytes`,\n`max_merge_keys`, `alias_anchor_ratio` and the alias jump factor were\nenforced only by the two `Value` loaders. A typed target with a\ndefault-shaped configuration is served by the streaming deserializer,\nwhich never read those fields, so tightening any of them had no effect\non `from_str::\u003cT\u003e` for a struct target. The default document-length,\ndepth and alias-count caps were enforced on every path, so no input was\nunbounded; the gap affects callers who tightened the other budgets for\nhostile input.\n\nVersion 0.0.53 charges every budget on the streaming path as well and\nadds cross-path parity tests.\n\nUsers who cannot upgrade can deserialize into `noyalib::Value` first and\nconvert with `from_value`, or rely on `max_document_length` and\n`max_depth`, which were always applied on every path.",
  "id": "RUSTSEC-2026-0333",
  "modified": "2026-10-08T14:47:14Z",
  "published": "2026-10-06T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/noyalib"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2026-0333.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sebastienrousseau/noyalib/pull/470"
    }
  ],
  "related": [],
  "severity": [],
  "summary": "Resource budgets not enforced on the typed deserialization path"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.