-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how borsh handles ZST deserialization in collection types. The core issue occurs in sequence deserialization logic where the implementation:- 1. Reads a length value (e.g., for Vec<T>), 2. Attempts to create N instances of T through repeated deserialization calls. For ZSTs (which occupy 0 bytes), this creates multiple logical instances without consuming bytes from the input stream. For non-Copy ZSTs (like singletons), this violates Rust's ownership rules as multiple mutable references to the same conceptual memory location are created, leading to UB. The fix in patched versions adds explicit ZST handling requiring Copy trait bounds, confirming this was the vulnerable area.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| borsh | rust | <= 0.10.3 | 1.0.0-alpha.1 |