Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
xxhash-rust accepts too‑short secret and can crash
published 16 days ago
Summary
The xxhash‑rust library (version 0.8.15) lets programs provide a secret that is shorter than required. When this happens in a normal (release) build, the code can create an invalid memory reference, which may cause the program to stop working unexpectedly. Update to a fixed version of the library or avoid using a custom secret until the issue is patched.
What to do
- Update doumanash xxhash-rust to version 0.8.16.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | doumanash | xxhash-rust |
< 0.8.16 Fix: upgrade to 0.8.16
|
Original advisory text
xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
I have a minimized safe Rust witness for xxhash-rust 0.8.15.
Safe public route:
xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])
The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.
Observed diagnostic:
Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference
Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.
Local artifacts:
- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md
Safe public route:
xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])
The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.
Observed diagnostic:
Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference
Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.
Local artifacts:
- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-125Out-of-bounds Read
Timeline
Published2 Oct 2026
Updated2 Oct 2026
First seen2 Oct 2026
Sources
GHSA-6g2r-675j-hx59 · GHSA
Track software like this
Free during beta