Rust advisories / rocksdb
Vulnerability MediumRUSTSEC-2022-0046 · rocksdb
RUSTSEC-2022-0046: Out-of-bounds read when opening multiple column families with TTL
Short answerA security vulnerability in the rocksdb crate: Out-of-bounds read when opening multiple column families with TTL. GitHub rates it Medium. Fixed in 0.19.0: update to a fixed version.
| Crate | rocksdb |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Before 0.19.0. |
| Fixed in | 0.19.0 |
| Severity | Medium (GitHub rating) |
| Published | 2022-05-11 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-xpp3-xrff-w6rh |
| Affected functions | rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl |
What to do
- See which version you have:
cargo tree -i rocksdb(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p rocksdb. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplerocksdb = "0.19.0") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Affected versions of this crate called the RocksDB C API rocksdb_open_column_families_with_ttl() with a pointer to a single integer TTL value, but one TTL value for each column family is expected.
This is only relevant when using rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl() with multiple column families.
This bug has been fixed in v0.19.0.
References
- Package: crates.io/crates/rocksdb
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0046.html
- Web: github.com/rust-rocksdb/rust-rocksdb/pull/616
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?