Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-25004: Rust Flatbuffers: Malicious input can be misinterpreted as true or false
CVE-2019-25004 · published 5 years ago
Summary
The Flatbuffers crate for Rust does not properly handle certain inputs, which means that attackers could trick the program into thinking a malicious input is true or false when it shouldn't be. This could lead to unexpected behavior or security issues. To fix the issue, update to version 0.6.1 or later.
What to do
- Update caspern flatbuffers to version 0.6.1.
- Update google flatbuffers to version 0.6.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | caspern | flatbuffers |
>= 0.4.0, < 0.6.1 Fix: upgrade to 0.6.1
|
| – | flatbuffers |
>= 0.4.0, < 0.6.1 cpe:2.3:a:google:flatbuffers:*:*:*:*:*:rust:*:* |
Original advisory text
An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-704Incorrect Type Conversion or Cast
Timeline
Published31 Dec 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta