RUSTSEC-2021-0054: Archives may contain uninitialized memory

What to do

1. See which version you have: cargo tree -i rkyv (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rkyv. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rkyv = "0.6.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

rkyv is a serialization framework that writes struct-compatible memory to be stored or transmitted. During serialization, struct padding bytes and unused enum bytes may not be initialized. These bytes may be written to disk or sent over unsecured channels.

References

• Package: crates.io/crates/rkyv
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0054.html
• Report: github.com/djkoloski/rkyv/issues/113

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for rkyv

• VulnerabilityRUSTSEC-2026-0001 · 2026-01-05Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
• UnsoundRUSTSEC-2026-0122 · 2026-04-23Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
• VulnerabilityRUSTSEC-2026-0233 · 2026-05-11Crafted archives can cause a use-after-free during deserialization
• VulnerabilityRUSTSEC-2026-0234 · 2026-05-11Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
• VulnerabilityRUSTSEC-2026-0235 · 2026-05-13Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Full security history of rkyv