{"id":"RUSTSEC-2024-0449","title":"unsafe-libyaml is unmaintained","summary":"unsafe-libyaml is unmaintained","severity":"none","vendor":"unsafe-libyaml","product":"unsafe-libyaml","ecosystem":"rust","affected":["unsafe-libyaml >= 0.0.0-0"],"published":"2024-03-25","updated":"2026-10-12","sourceUpdated":"2026-10-12T11:45:02.518189315Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0449","references":[{"url":"https://crates.io/crates/unsafe-libyaml"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0449.html"},{"url":"https://github.com/dtolnay/unsafe-libyaml"}],"tags":["osv","rust"],"ingestedAt":"2026-10-13T11:45:30.176Z","slug":"RUSTSEC-2024-0449","body":"## Overview\n\nThe [repository](https://github.com/dtolnay/unsafe-libyaml) was archived by\nits owner on 2024-03-25 and is read-only. The last release is 0.2.11\n(March 2024).\n\n`unsafe-libyaml` is a machine translation of libyaml's C code into unsafe\nRust (c2rust). Bugs found in it will not be fixed upstream. It is used by\n`serde_yaml` (itself deprecated) and by forks such as `serde_yaml_ng`.\n\n## Alternatives\n\nConsider a YAML parser written in safe Rust, for example:\n\n- [saphyr](https://crates.io/crates/saphyr) ([serde-saphyr](https://crates.io/crates/serde-saphyr) for serde users)\n- [noyalib](https://crates.io/crates/noyalib)\n\n## Affected packages\n\n- `unsafe-libyaml >= 0.0.0-0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}