RUSTSEC-2022-0068: out-of-bounds read possible when setting list-of-pointers

What to do

1. See which version you have: cargo tree -i capnp (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p capnp. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example capnp = "0.15.2") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

If a message consumer expects data of type "list of pointers", and if the consumer performs certain specific actions on such data, then a message producer can cause the consumer to read out-of-bounds memory. This could trigger a process crash in the consumer, or in some cases could allow exfiltration of private in-memory data.

The C++ Cap'n Proto library is also affected by this bug. See the advisory on the main Cap'n Proto repo for a succinct description of the exact circumstances in which the problem can arise.

References

• Package: crates.io/crates/capnp
• Advisory: rustsec.org/advisories/RUSTSEC-2022-0068.html
• Web: github.com/capnproto/capnproto/tree/master/security-advisories/2022-11-30-0-pointer-list-bounds.md
• Web: dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html
• Advisory: github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for capnp

• VulnerabilityRUSTSEC-2025-0143 · 2025-12-24Unsound APIs of public `constant::Reader` and `StructSchema`

Full security history of capnp