---
id: RUSTSEC-2024-0449
title: unsafe-libyaml is unmaintained
summary: unsafe-libyaml is unmaintained
severity: none
vendor: unsafe-libyaml
product: unsafe-libyaml
ecosystem: rust
affected:
  - unsafe-libyaml >= 0.0.0-0
published: '2024-03-25'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T11:45:02.518189315Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2024-0449'
references:
  - url: 'https://crates.io/crates/unsafe-libyaml'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2024-0449.html'
  - url: 'https://github.com/dtolnay/unsafe-libyaml'
tags:
  - osv
  - rust
ingestedAt: '2026-10-13T11:45:30.176Z'
---

## Overview

The [repository](https://github.com/dtolnay/unsafe-libyaml) was archived by
its owner on 2024-03-25 and is read-only. The last release is 0.2.11
(March 2024).

`unsafe-libyaml` is a machine translation of libyaml's C code into unsafe
Rust (c2rust). Bugs found in it will not be fixed upstream. It is used by
`serde_yaml` (itself deprecated) and by forks such as `serde_yaml_ng`.

## Alternatives

Consider a YAML parser written in safe Rust, for example:

- [saphyr](https://crates.io/crates/saphyr) ([serde-saphyr](https://crates.io/crates/serde-saphyr) for serde users)
- [noyalib](https://crates.io/crates/noyalib)

## Affected packages

- `unsafe-libyaml >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.