Rust advisories / mail-internals
Vulnerability MediumRUSTSEC-2023-0054 · mail-internals
RUSTSEC-2023-0054: Use-after-free in `vec_insert_bytes`
Short answerA security vulnerability in the mail-internals crate: Use-after-free in `vec_insert_bytes`. GitHub rates it Medium. No fixed version: replace the crate or remove the affected code path.
| Crate | mail-internals |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2023-08-07 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-rcx8-48pc-v9q8 |
| Affected functions | mail_internals::utils::vec_insert_bytes |
What to do
- Find who pulls it in:
cargo tree -i mail-internals. - Avoid the affected API (
mail_internals::utils::vec_insert_bytes), or replace the crate.
Details from the advisory
Incorrect reallocation logic in the function vec_insert_bytes causes a use-after-free.
This function does not have to be called directly to trigger the vulnerability because many methods on EncodingWriter call this function internally.
The mail-\* suite is unmaintained and the upstream sources have been actively vandalised. A fixed mail-internals-ng (and mail-headers-ng and mail-core-ng) crate has been published which fixes this, and a dependency on another unsound crate.
References
- Package: crates.io/crates/mail-internals
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0054.html
- Web: git.sr.ht/~nabijaczleweli/mail-internals.crate/commit/05443c864b204e7f1512caf2d53e8cce4dd340fc
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?