{"id":"CVE-2023-42447","aliases":["RUSTSEC-2023-0083","GHSA-cxvp-82cq-57h2"],"title":"blurhash: panic on parsing crafted blurhash inputs","summary":"blurhash: panic on parsing crafted blurhash inputs","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","vendor":"blurhash","product":"blurhash","ecosystem":"rust","affected":["blurhash >= 0.0.0-0, < 0.2.0"],"patched":["blurhash 0.2.0"],"published":"2023-09-19","updated":"2026-10-13","sourceUpdated":"2026-10-13T15:15:50.817581277Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0083","references":[{"url":"https://crates.io/crates/blurhash"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0083.html"},{"url":"https://github.com/whisperfish/blurhash-rs/commit/e1b3209734d2a2704ed5ddcf61dc0beab6caa64d"},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42447"}],"tags":["osv","rust"],"epss":0.00624,"epssPercentile":0.49689,"ingestedAt":"2026-10-13T11:45:30.162Z","slug":"CVE-2023-42447","body":"## Overview\n\n## Impact\nThe blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.\n\nIn a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:\n- UTF-8 compliant strings containing multi-byte UTF-8 characters\n\n## Patches\nThe patches were released under version 0.2.0, which may require user intervention because of slight API churn.\n\n## Affected packages\n\n- `blurhash >= 0.0.0-0, < 0.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `blurhash 0.2.0`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}