Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
xxhash‑rust may crash with too‑short secret
published 16 days ago
Summary
The Rust library xxhash‑rust version 0.8.15 can create an invalid memory reference if a custom secret used for hashing is shorter than required. This can cause the program to behave unpredictably or stop working. Update to a fixed version or ensure that any secret passed to the xxh3 functions meets the library’s minimum length requirements.
What to do
- Update doumanash xxhash-rust to version 0.8.16.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| crates.io | doumanash | xxhash-rust |
< 0.8.16 Fix: upgrade to 0.8.16
|
Original advisory text
xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
I have a minimized safe Rust witness for xxhash-rust 0.8.15.
Safe public route:
xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])
The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.
Observed diagnostic:
Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference
Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.
Local artifacts:
- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md
Safe public route:
xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])
The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.
Observed diagnostic:
Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference
Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.
Local artifacts:
- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-125Out-of-bounds Read
Timeline
Published2 Oct 2026
Updated2 Oct 2026
First seen2 Oct 2026
Sources
GHSA-6g2r-675j-hx59 · OSV
Track software like this
Free during beta