-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in multiple functions within the shaman::cryptoutil module. According to the security advisory RUSTSEC-2025-0113, functions such as read_u32v_be, read_u32v_le, read_u64v_be, read_u64v_le, write_u32v_le, and write_u64v_le have a soundness issue. Specifically, they use get_unchecked without proper bounds checking, which can lead to out-of-bounds memory access if the input length is zero. Since the shaman crate is unmaintained, no patch is available to fix this issue. The identified functions are directly listed in the security advisory as being affected.
shaman::cryptoutil::read_u32v_besrc/cryptoutil.rs
shaman::cryptoutil::read_u32v_lesrc/cryptoutil.rs
shaman::cryptoutil::read_u64v_besrc/cryptoutil.rs
shaman::cryptoutil::read_u64v_lesrc/cryptoutil.rs
shaman::cryptoutil::write_u32v_lesrc/cryptoutil.rs
shaman::cryptoutil::write_u64v_lesrc/cryptoutil.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shaman | rust | <= 0.1.0 |
RustRustOngoing coverage of React2Shell