fix(deps): bump rkyv to 0.8.17 and bytes to 1.11.1 to resolve multiple CVEs - #7
Open
ygd58 wants to merge 1 commit into
Open
fix(deps): bump rkyv to 0.8.17 and bytes to 1.11.1 to resolve multiple CVEs#7ygd58 wants to merge 1 commit into
ygd58 wants to merge 1 commit into
Conversation
…e CVEs rkyv 0.8.12 has three unpatched memory-corruption/memory-exposure issues affecting archive deserialization: - RUSTSEC-2026-0001: potential UB in Arc<T>/Rc<T> from_value on OOM - RUSTSEC-2026-0233: use-after-free during deserialization of crafted archives - RUSTSEC-2026-0234/0235: out-of-bounds reads via insufficient archive validation (hash tables, Rc/Arc) rkyv is pinned at the workspace root and used across nearly every crate in this repo (psy_core, psy_data, parth_crypto, etc.), so these are reachable wherever archived/serialized data of unknown origin is deserialized. bytes 1.11.0 has RUSTSEC-2026-0007, an integer overflow in BytesMut::reserve that can lead to memory corruption. Both are patch-level bumps within their existing branches (0.8.12->0.8.17, 1.11.0->1.11.1) with unchanged public API surface. Verified: cargo build --release succeeds cleanly for the full workspace (nightly-2025-09-20 toolchain).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Bump
rkyv0.8.12 -> 0.8.17 andbytes1.11.0 -> 1.11.1 in Cargo.lock (workspace-level version bump for rkyv in Cargo.toml).Why
rkyv0.8.12 has three unpatched advisories affecting archive deserialization:rkyv is pinned at the workspace root and used across nearly every crate in this repo, so these are reachable wherever archived/serialized data of unknown origin is deserialized.
bytes1.11.0 has RUSTSEC-2026-0007, an integer overflow inBytesMut::reservethat can lead to memory corruption.Both are patch-level bumps within their existing minor version branches, with unchanged public API/dependency surface.
Compatibility
None expected — patch-level bumps only.
Validation
cargo build --releasesucceeds cleanly for the full workspace (nightly-2025-09-20 toolchain).Side note
While setting up a clean build for this PR, I noticed the repo doesn't build from a fresh clone without
git submodule update --init --recursive(psy-genesis submodule is required at build time by psy_config's build.rs). Happy to send a small README PR documenting that step separately if useful.Advisories:
Arc<T>/Rc<T>impls offrom_valueon OOM rkyv/rkyv#644ArchivedString::deserializefor#[derive(Archive)]struct with String fields rkyv/rkyv#666from_bytes::<HashMap<String, _>>via crafted ArchivedString pointer rkyv/rkyv#663Rcrkyv/rkyv#670