Rust advisories / kamadak-exif
Vulnerability MediumRUSTSEC-2021-0143 · kamadak-exif
RUSTSEC-2021-0143: kamadak-exif DoS with untrusted PNG data
Short answerA security vulnerability in the kamadak-exif crate: kamadak-exif DoS with untrusted PNG data. Medium severity (CVSS 6.5). Fixed in 0.5.3: update to a fixed version.
| Crate | kamadak-exif |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 0.5.2 before 0.5.3. |
| Fixed in | 0.5.3 |
| Severity | Medium, CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| Published | 2021-01-04 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2021-21235, GHSA-px9g-8hgv-jvg2 |
| Affected functions | kamadak_exif::Reader::read_from_container |
What to do
- See which version you have:
cargo tree -i kamadak-exif(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p kamadak-exif. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplekamadak-exif = "0.5.3") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Attacker crafted data can cause a infinite loop leading to DoS if used with untrusted data.
References
- Package: crates.io/crates/kamadak-exif
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0143.html
- Web: github.com/kamadak/exif-rs/commit/1b05eab57e484cd7d576d4357b9cda7fdc57df8c
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?