GHSA-5w5r-mf82-595p: Capnp :Reader And StructSchema Vulnerability

CRITICAL
Share
CWE-758
Published
Advisory Summary

GHSA-5w5r-mf82-595p is a CRITICAL :reader and structschema vulnerability (CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior) affecting Capnp libraries in the crates.io ecosystem. The issue involves :reader and structschema. Remediation is available by upgrading affected packages to version 0.24.0.

GHSA-5w5r-mf82-595p at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-5w5r-mf82-595p
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
Affected Product Capnp
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-5w5r-mf82-595p

To remediate this vulnerability, upgrade all affected Capnp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

capnp fixed: 0.24.0 
Upgrade capnp to 0.24.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for capnp

How to Check if You Are Affected

To determine whether your application is affected by GHSA-5w5r-mf82-595p, inspect your project dependencies for Capnp:

inspect dependencies for capnp

Analyze the terminal output to locate any version of Capnp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.24.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior, where the product uses an api function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity. In Capnp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas. ## `Reader::get` ```rust pub fn get(&self) -> Result<<T as Owned>::Reader<'static>> { // ... // UNSAFE: access `words` without validation } ``` ## `StructSchema::new` ```rust pub fn new(builder: RawBrandedStructSchema) -> StructSchema { // ... // UNSAFE: access encoded nodes without validation } ``` This vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees. The issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.

GHSA-5w5r-mf82-595p Affected Capnp Versions

1 component(s)
Fixed Versions:
0.24.0
Product / Package Ecosystem Affected Versions Fixed Version
capnp
 crates.io
< 0.24.0
0.24.0

References

Capnp Source Repository REPOSITORY
https://github.com/capnproto/capnproto-rust/issues/605
Security Fix Commit FIX COMMIT
https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf
Security Fix Commit FIX COMMIT
https://github.com/capnproto/capnproto-rust/commit/e3aeec213e6d1b30a182bf61682a370f20d8a02c
Capnp Source Repository REPOSITORY
https://github.com/capnproto/capnproto-rust
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2025-0143.html

Frequently Asked Questions

What is GHSA-5w5r-mf82-595p?
GHSA-5w5r-mf82-595p is a security vulnerability in Capnp involving :Reader and StructSchema under CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior.
Which Capnp versions are affected?
Affected versions include releases prior to 0.24.0 across affected packages: capnp.
What version fixes GHSA-5w5r-mf82-595p?
Upgrading to 0.24.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is capnp affected?
Yes, capnp is affected in releases prior to 0.24.0. Upgrade your dependency to 0.24.0 or later.
What CWE is associated with GHSA-5w5r-mf82-595p?
GHSA-5w5r-mf82-595p is classified under CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior (The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.).
How can I check crates.io dependencies for GHSA-5w5r-mf82-595p?
Run the dependency tree command: 'inspect dependencies for capnp'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5w5r-mf82-595p",
  "modified" : "2026-01-28T16:06:09Z",
  "published" : "2026-01-28T16:06:09Z",
  "aliases" : [ ],
  "summary" : "Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema",
  "details" : "The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(&self) -> Result<<T as Owned>::Reader<'static>> {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -> StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "capnp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.24.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/capnproto/capnproto-rust/issues/605"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/capnproto/capnproto-rust/commit/e3aeec213e6d1b30a182bf61682a370f20d8a02c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/capnproto/capnproto-rust"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2025-0143.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-758" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-28T16:06:09Z",
    "nvd_published_at" : null
  }
}