RUSTSEC-2021-0122: Generated code can read and write out of bounds in safe code

What to do

1. See which version you have: cargo tree -i flatbuffers (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p flatbuffers. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example flatbuffers = "22.9.29") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Code generated by flatbuffers' compiler is unsafe but not marked as such. See https://github.com/google/flatbuffers/issues/6627 for details.

For example, if generated code is used to decode malformed or untrusted input, undefined behavior (and thus security vulnerabilities) is possible even without the use of the unsafe keyword, violating the the meaning of "safe" code;

All users that use generated code by flatbuffers compiler are recommended to: 1. not expose flatbuffer generated code as part of their public APIs 2. audit their code and look for any usage of follow, push, or any method that uses them (e.g. self_follow). 3. Carefully go through the crates' documentation to understand which "safe" APIs are not intended to be used.

References

• Package: crates.io/crates/flatbuffers
• Advisory: rustsec.org/advisories/RUSTSEC-2021-0122.html
• Report: github.com/google/flatbuffers/issues/6627

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for flatbuffers

• Vulnerability CriticalRUSTSEC-2019-0028 · 2019-10-20Unsound `impl Follow for bool`
• Vulnerability HighRUSTSEC-2020-0009 · 2020-04-11`read_scalar` and `read_scalar_at` allow transmuting values without `unsafe` blocks

Full security history of flatbuffers