RUSTSEC-2024-0449None▾ Sunlitunsafe-libyaml is unmaintained
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
The repository was archived by its owner on 2024-03-25 and is read-only. The last release is 0.2.11 (March 2024).
unsafe-libyaml is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
serde_yaml (itself deprecated) and by forks such as serde_yaml_ng.
Consider a YAML parser written in safe Rust, for example:
unsafe-libyaml >= 0.0.0-0Refer to the advisory for the patched release.