GHSA-6g2r-675j-hx59: xxhash-rust Safe Xxh3 Custom-secret API Accepts Vulnerability

LOW
Share
CVSS 2.3
CWE-125
Published
Advisory Summary

GHSA-6g2r-675j-hx59 is a LOW (CVSS 2.3) safe xxh3 custom-secret api accepts vulnerability (CWE-125: Out-of-bounds Read) affecting xxhash-rust libraries in the crates.io ecosystem. The issue involves safe xxh3 custom-secret api accepts too-short secret in release. Remediation is available by upgrading affected packages to version 0.8.16.

GHSA-6g2r-675j-hx59 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-6g2r-675j-hx59
Severity LOW
CVSS v3.1 Base Score 2.3
CWE Classification CWE-125: Out-of-bounds Read
Affected Product xxhash-rust
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 2.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required High (PR:H)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix GHSA-6g2r-675j-hx59

To remediate this vulnerability, upgrade all affected xxhash-rust dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

xxhash-rust fixed: 0.8.16 
Upgrade xxhash-rust to 0.8.16
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for xxhash-rust

How to Check if You Are Affected

To determine whether your application is affected by GHSA-6g2r-675j-hx59, inspect your project dependencies for xxhash-rust:

inspect dependencies for xxhash-rust

Analyze the terminal output to locate any version of xxhash-rust in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.8.16), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In xxhash-rust, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

I have a minimized safe Rust witness for xxhash-rust 0.8.15. Safe public route: xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[]) The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation. Observed diagnostic: Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri. Local artifacts: - vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log - repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log - report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md

GHSA-6g2r-675j-hx59 Affected xxhash-rust Versions

1 component(s)
Fixed Versions:
0.8.16
Product / Package Ecosystem Affected Versions Fixed Version
xxhash-rust
 crates.io
< 0.8.16
0.8.16

References

GitHub Advisory / Wiki ADVISORY
https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59
Security Fix Commit FIX COMMIT
https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200
xxhash-rust Source Repository REPOSITORY
https://github.com/DoumanAsh/xxhash-rust

Frequently Asked Questions

What is GHSA-6g2r-675j-hx59?
GHSA-6g2r-675j-hx59 is a security vulnerability in xxhash-rust involving Safe xxh3 custom-secret API accepts too-short secret in release under CWE-125: Out-of-bounds Read.
Which xxhash-rust versions are affected?
Affected versions include releases prior to 0.8.16 across affected packages: xxhash-rust.
What version fixes GHSA-6g2r-675j-hx59?
Upgrading to 0.8.16 (or the latest patched release for your respective branch) resolves the vulnerability.
Is xxhash-rust affected?
Yes, xxhash-rust is affected in releases prior to 0.8.16. Upgrade your dependency to 0.8.16 or later.
What is the CVSS score of GHSA-6g2r-675j-hx59?
GHSA-6g2r-675j-hx59 has a CVSS v3.1 base score of 2.3 (LOW) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with GHSA-6g2r-675j-hx59?
GHSA-6g2r-675j-hx59 is classified under CWE-125: Out-of-bounds Read (The product reads data past the end, or before the beginning, of the intended buffer.).
How can I check crates.io dependencies for GHSA-6g2r-675j-hx59?
Run the dependency tree command: 'inspect dependencies for xxhash-rust'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6g2r-675j-hx59",
  "modified" : "2026-10-02T18:29:13Z",
  "published" : "2026-10-02T18:29:13Z",
  "aliases" : [ ],
  "summary" : "xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release",
  "details" : "I have a minimized safe Rust witness for xxhash-rust 0.8.15.\n\nSafe public route:\n\nxxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])\n\nThe caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.\n\nObserved diagnostic:\n\nUndefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference\n\nLocal repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.\n\nLocal artifacts:\n- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log\n- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log\n- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "xxhash-rust"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.8.16"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/DoumanAsh/xxhash-rust/security/advisories/GHSA-6g2r-675j-hx59"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/DoumanAsh/xxhash-rust/commit/200cadb1a442c7f6cd9747e7d4297379b6b74200"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/DoumanAsh/xxhash-rust"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-02T18:29:13Z",
    "nvd_published_at" : null
  }
}