---
id: CVE-2023-42447
aliases:
  - RUSTSEC-2023-0083
  - GHSA-cxvp-82cq-57h2
title: 'blurhash: panic on parsing crafted blurhash inputs'
summary: 'blurhash: panic on parsing crafted blurhash inputs'
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'
vendor: blurhash
product: blurhash
ecosystem: rust
affected:
  - 'blurhash >= 0.0.0-0, < 0.2.0'
patched:
  - blurhash 0.2.0
published: '2023-09-19'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T15:15:50.817581277Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2023-0083'
references:
  - url: 'https://crates.io/crates/blurhash'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0083.html'
  - url: >-
      https://github.com/whisperfish/blurhash-rs/commit/e1b3209734d2a2704ed5ddcf61dc0beab6caa64d
  - url: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42447'
tags:
  - osv
  - rust
epss: 0.00624
epssPercentile: 0.49689
ingestedAt: '2026-10-13T11:45:30.162Z'
---

## Overview

## Impact
The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.

In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:
- UTF-8 compliant strings containing multi-byte UTF-8 characters

## Patches
The patches were released under version 0.2.0, which may require user intervention because of slight API churn.

## Affected packages

- `blurhash >= 0.0.0-0, < 0.2.0`

## Remediation

Upgrade to a patched release:

- `blurhash 0.2.0`