rkyv (crates.io)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.8.17 or later clears every advisory below that has a fix.

Upgrade commands

cargo

cargo update -p rkyv --precise 0.8.17

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
RUSTSEC-2026-0235 Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc	Not rated yet	`>= 0.7.0-pre.2, < 0.8.17`	`0.8.17`
RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables	Not rated yet	`>= 0.8.0-rc.1, < 0.8.17`	`0.8.17`
RUSTSEC-2026-0233 Crafted archives can cause a use-after-free during deserialization	Not rated yet	`>= 0.8.0-rc.1, < 0.8.17`	`0.8.17`
GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution	Medium	`>= 0.8.0, < 0.8.16`	`0.8.16`
GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution	Medium	`>= 0.8.0, < 0.8.16`	`0.8.16`
RUSTSEC-2026-0001 Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM	Not rated yet	`>= 0.0.0-0, < 0.7.46` `>= 0.8.0, < 0.8.13`	`0.7.46` `0.8.13`
GHSA-w5cr-frph-hw7f Use of uninitialized buffer in rkyv	High EPSS 1.08%	`>= 0.0.0-0, < 0.6.0`	`0.6.0`
GHSA-w5cr-frph-hw7f Use of uninitialized buffer in rkyv	High EPSS 1.08%	`< 0.6.0`	`0.6.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor