Unsound MediumRUSTSEC-2022-0092 · rmp-serde
RUSTSEC-2022-0092: `rmp-serde` `Raw` and `RawRef` unsound
Short answerrmp-serde has an API that can cause undefined behaviour from safe code: `rmp-serde` `Raw` and `RawRef` unsound. Fixed in 1.1.1.
| Crate | rmp-serde |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Before 1.1.1. |
| Fixed in | 1.1.1 |
| Severity | Medium (GitHub rating) |
| Published | 2022-04-13 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-255r-3prx-mf99 |
What to do
- See which version you have:
cargo tree -i rmp-serde(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p rmp-serde. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplermp-serde = "1.1.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
It was found that Raw::from_utf8 expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash.
References
- Package: crates.io/crates/rmp-serde
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0092.html
- Report: github.com/3Hren/msgpack-rust/issues/305
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same cratermp-serde: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?