RUSTSEC-2026-0123: Out-of-bounds read in `bytes_helper` public safe functions

What to do

1. See which version you have: cargo tree -i rustdx (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rustdx. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rustdx = "0.4.4") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

The bytes_helper module contains multiple public functions (into_arr4(), into_arr2(), u8_from_le_bytes()) that use slice.get_unchecked(pos..pos + N) without verifying that pos + N <= slice.len(). These are public safe API functions, allowing any caller to trigger undefined behavior by passing invalid positions.

For example, calling into_arr4(&data, 10) where data is a 3-byte slice causes an out-of-bounds access since position 10 exceeds the slice length.

References

• Package: crates.io/crates/rustdx
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0123.html
• Report: github.com/zjp-CN/rustdx/issues/38

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.