GHSA-3288-p39f-rqpv Unsoundness in opt-in ARMv8 assembly backend for `keccak`
Unsoundness in the opt-in ARMv8 assembly backend of the keccak crate could theoretically lead to memory safety issues, though no practical impact was observed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3288-p39f-rqpv?
GHSA-3288-p39f-rqpv is a memory corruption vulnerability in keccak, published on 12 Feb 2026.
Official description
Summary
The asm! block enabled by the off-by-default asm feature, when enabled on ARMv8 targets, misspecified the operand
type for all of its operands, using in for pointers and values which were subsequently mutated by operations performed
within the assembly block.
Impact
It's unclear what practical impact, if any, this actually had. Incorrect operand types are technically undefined behavior, however changing them had no actual impact on the generated assembly for these targets. The possibility still exists that it may lead to potential memory safety or other issues on hypothetical future versions of rustc.
Mitigation
The operand types were changed from in to inout, and the impacted versions of the keccak crate were yanked.
Which versions are affected by GHSA-3288-p39f-rqpv?
3 open source packages ship an affected version, including keccak.
| Package | Affected | Fixed in |
|---|---|---|
keccak crates.io | All versions | 0.1.6 |
keccak crates.io | All versions | 0.1.6 |
keccak crates.io | From 0.0.0-0 | 0.1.6 |
How do I fix GHSA-3288-p39f-rqpv?
Upgrade keccak to 0.1.6 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-3288-p39f-rqpv being exploited?
There is no known exploitation of GHSA-3288-p39f-rqpv in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0012.