GHSA-3jch-9qgp-4844 — Vulnerability in flatbuffers — Advisory Details

CRITICAL

Generated code can read and write out of bounds in safe code

Published June 16, 2022Updated November 8, 2023Source: osv

Summary

Code generated by flatbuffers' compiler is `unsafe` but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details. All users that use generated code by `flatbuffers` compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit their code and look for any usage of `follow`, `push`, or any method that uses them (e.g. `self_follow`). 3. Carefuly go through the crates' documentation to understand which "safe" APIs are not intended to be used.

Advisory Timeline

First published June 16, 2022 (1579 days ago).
Last revised November 8, 2023 — 509 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update flatbuffers to 22.9.29 or later

cargo update -p flatbuffers --precise 22.9.29

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
flatbuffers	crates.io	All versions	22.9.29

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is GHSA-3jch-9qgp-4844?: Generated code can read and write out of bounds in safe code This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by GHSA-3jch-9qgp-4844?: GHSA-3jch-9qgp-4844 affects flatbuffers. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-3jch-9qgp-4844 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

RUSTSEC-2021-0122

Related CVEs

CVE-2019-25004
CRITICAL
Unsound `impl Follow for bool`
RUSTSEC-2026-0327
CRITICAL
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
CVE-2026-75856
CRITICAL
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
CVE-2019-25004
CRITICAL
Unsound casting in flatbuffers

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies