{"id":"GHSA-4xcc-23fx-w2wj","revision":null,"records":[{"revision":"9e73ae516d80403dbd73ba5b03ff94e7","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0333","aliases":["GHSA-4xcc-23fx-w2wj"],"title":"Resource budgets not enforced on the typed deserialization path","description":"`ParserConfig::max_events`, `max_nodes`, `max_total_scalar_bytes`,\n`max_merge_keys`, `alias_anchor_ratio` and the alias jump factor were\nenforced only by the two `Value` loaders. A typed target with a\ndefault-shaped configuration is served by the streaming deserializer,\nwhich never read those fields, so tightening any of them had no effect\non `from_str::<T>` for a struct target. The default document-length,\ndepth and alias-count caps were enforced on every path, so no input was\nunbounded; the gap affects callers who tightened the other budgets for\nhostile input.\n\nVersion 0.0.53 charges every budget on the streaming path as well and\nadds cross-path parity tests.\n\nUsers who cannot upgrade can deserialize into `noyalib::Value` first and\nconvert with `from_value`, or rely on `max_document_length` and\n`max_depth`, which were always applied on every path.","state":0,"publishedAt":"2026-10-06T12:00:00+00:00","modifiedAt":"2026-10-08T15:00:03.2043569+00:00","affected":[{"ecosystem":"crates.io","name":"noyalib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.0.53"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://crates.io/crates/noyalib","https://rustsec.org/advisories/RUSTSEC-2026-0333.html","https://github.com/sebastienrousseau/noyalib/pull/470"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0333","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0333","identifiers":["RUSTSEC-2026-0333","GHSA-4xcc-23fx-w2wj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T23:24:26.2497022+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-10T23:24:26.2497022+00:00","lastSuccessAt":"2026-11-10T23:24:26.4130511+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:24:26.4130547+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-7b65173981f9a3e6b028167551da2fbe2b2ca16937612172afde4e08a8fda3a3","complete":true,"records":423844,"lastAttemptAt":"2026-11-10T23:21:45.6230866+00:00","lastSuccessAt":"2026-11-10T23:21:44.6693889+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:21:45.6230866+00:00","snapshotPublishedAt":"2026-11-10T22:28:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-09978f142065457e900e9248e8baea1e","complete":false,"records":13718,"lastAttemptAt":"2026-11-10T23:33:53.5990784+00:00","lastSuccessAt":"2026-11-10T23:33:53.595+00:00","error":"7 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T23:33:53.595+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13765,"expectedIdentifiers":13772,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T23:24:26.2497022+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-10T23:24:26.2497022+00:00","lastSuccessAt":"2026-11-10T23:24:30.0220229+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:24:30.0220363+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a7cb49a2450d454daefd3112114b4a24","complete":true,"records":13724,"lastAttemptAt":"2026-11-10T23:24:31.4124902+00:00","lastSuccessAt":"2026-11-10T23:24:31.409+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:24:31.409+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13772,"expectedIdentifiers":13772,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-e41003cabc4bca6ffa7416326ea16ef9368e02303054ea1c5ab1ac33fb67507c","complete":true,"records":9935,"lastAttemptAt":"2026-11-10T23:24:26.0608595+00:00","lastSuccessAt":"2026-11-10T20:24:04.2273564+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:24:26.0608595+00:00","snapshotPublishedAt":"2026-11-10T20:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-0343d72573f85daced07eff7996184a314775f6f34677217a13db575eb00fb06","complete":true,"records":1979,"lastAttemptAt":"2026-11-10T23:21:56.1190822+00:00","lastSuccessAt":"2026-11-10T23:21:55.9889354+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:21:56.1190822+00:00","snapshotPublishedAt":"2026-11-10T23:17:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0e3796c351bac632fda8fc3b3641da2bc6f0237cd79e78b1e59d17ce0aa22d32","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T23:24:26.2130132+00:00","lastSuccessAt":"2026-11-10T20:24:10.5326555+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:24:26.2130132+00:00","snapshotPublishedAt":"2026-11-10T20:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-7d419d87691cf1228c70d87c0c46dabe06fc6a81d4e618c9c34166e51db27f32","complete":true,"records":231645,"lastAttemptAt":"2026-11-10T23:24:25.9326105+00:00","lastSuccessAt":"2026-11-10T23:24:24.4211708+00:00","error":null,"lastVerifiedAt":"2026-11-10T23:24:25.9326105+00:00","snapshotPublishedAt":"2026-11-10T23:02:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}