Rust advisories / buf_redux
UnmaintainedRUSTSEC-2023-0028 · buf_redux
RUSTSEC-2023-0028: buf_redux is Unmaintained
Short answerNot a bug report: buf_redux is no longer maintained, so future security issues will not be fixed. Plan to move to a maintained alternative.
| Crate | buf_redux |
|---|---|
| Type | Unmaintained |
| Affected versions | Every version. |
| Fixed in | not applicable (the crate is unmaintained) |
| Severity | not scored |
| Published | 2023-01-24 |
| Last changed | 2023-03-24 |
| Also known as | none |
What to do
- Look for a maintained fork or alternative crate.
- If you cannot move yet, acknowledge it in your audit config so CI stays green while you plan: add
"RUSTSEC-2023-0028"toignorein.cargo/audit.tomlordeny.toml, with a comment saying why. - Find who pulls it in:
cargo tree -i buf_redux.
Details from the advisory
Last release was over three years ago.
The maintainer(s) have been unreachable to respond to any issues that may or may not include security issues.
The repository is now archived and there is no security policy in place to contact the maintainer(s) otherwise.
The safety-undocumented unsafe in the crate may or may not be safe to use.
The crate also has a current future incompatibility warning buf_redux/23.
Possible Alternatives
The below may or may not provide alternative(s)
- Rust alloc / std vec::Vec, collections::VecDeque
- buffer-redux - fork
- bytes
- crates.io search for 'buffer'
References
- Package: crates.io/crates/buf_redux
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0028.html
- Web: github.com/abonander/buf_redux/issues
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?