Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

LibYML: Unsound and Unmaintained, Use Alternative LibYML Fork

published 1 year ago
Summary

LibYML version 0.0.4 has a critical flaw that can lead to unexpected behavior. This issue is not being fixed, so it's recommended to switch to a different version of LibYML. Consider using an alternative crate like LibYML Safer or Unsafe-LibYML Norway, which are being actively maintained.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
rust sebastienrousseau libyml >= 0.0.4, <= 0.0.5
Original advisory text
LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained
In version 0.0.4, `libyml::string::yaml_string_extend` was revised resulting in undefined behaviour, which is unsound.

The GitHub project for `libyml` was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

## Recommended alternatives

- [`libyaml-safer`](https://crates.io/crates/libyaml-safer)
- [`unsafe-libyaml-norway`](https://crates.io/crates/unsafe-libyaml-norway) - Maintained fork of `unsafe-libyaml`
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Type
CWE-758Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Timeline
Published15 Sep 2025
Updated13 Mar 2026
First seen6 Mar 2026
Sources
GHSA-gfxp-f68g-8x78 · GHSA
Track software like this
Free during beta