GHSA-m325-rxjv-pwph: Deserialization functions pass uninitialized memory to user-provided Read

The vulnerability stems from a pattern where: 1) Vectors are created with capacity 2) Unsafe set_len() is used to expand without initialization 3) The uninitialized buffer is passed to read_exact(). This violates Rust's safety requirements as per Read trait documentation. Multiple independent sources (GitHub advisory, RustSec advisory, and issue #2) explicitly name these four functions and show code examples demonstrating the unsafe pattern. The file path is confirmed through code snippets in the GitHub issue discussion.