Unsound CriticalRUSTSEC-2020-0027 · traitobject
RUSTSEC-2020-0027: traitobject assumes the layout of fat pointers
Short answertraitobject has an API that can cause undefined behaviour from safe code: traitobject assumes the layout of fat pointers. No fixed version yet.
| Crate | traitobject |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2020-06-01 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2020-35881, GHSA-j79j-cx3h-g27h |
| Affected functions | traitobject::data, traitobject::data_mut |
What to do
- Find who pulls it in:
cargo tree -i traitobject. - Avoid the affected API (
traitobject::data,traitobject::data_mut), or replace the crate.
Details from the advisory
This crate gets the data pointer from fat pointers assuming that the first element in a fat pointer is the data pointer. This is currently true, but it may change in a future Rust version, leading to memory corruption.
This has been fixed in the master branch of the crate, but is has not been released into crates.io.
References
- Package: crates.io/crates/traitobject
- Advisory: rustsec.org/advisories/RUSTSEC-2020-0027.html
- Report: github.com/reem/rust-traitobject/issues/7
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for traitobject
Up next
Same cratetraitobject: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?