RUSTSEC-2017-0004: Integer overflow leads to heap-based buffer overflow in encode_config_buf

What to do

1. See which version you have: cargo tree -i base64 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p base64. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example base64 = "0.5.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Affected versions of this crate suffered from an integer overflow bug when calculating the size of a buffer to use when encoding base64 using the encode_config_buf and encode_config functions. If the input string was large, this would cause a buffer to be allocated that was too small. Since this function writes to the buffer using unsafe code, it would allow an attacker to write beyond the buffer, causing memory corruption and possibly the execution of arbitrary code.

This flaw was corrected by using checked arithmetic to calculate the size of the buffer.

References

• Package: crates.io/crates/base64
• Advisory: rustsec.org/advisories/RUSTSEC-2017-0004.html
• Web: github.com/alicemaz/rust-base64/commit/24ead980daf11ba563e4fb2516187a56a71ad319

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.