{"answers":{"affected":"3 open source packages ship an affected version, including keccak.","exploited":"There is no known exploitation of GHSA-3288-p39f-rqpv in the wild and no public exploit code.","fix":"Upgrade keccak to 0.1.6 or later.","what":"GHSA-3288-p39f-rqpv is a memory corruption vulnerability in keccak, published on 12 Feb 2026."},"fix_prompt":"Check this codebase for GHSA-3288-p39f-rqpv and fix it if it is affected.\n\nWhat it is: GHSA-3288-p39f-rqpv is a memory corruption vulnerability in keccak, published on 12 Feb 2026. \nExploitation: There is no known exploitation of GHSA-3288-p39f-rqpv in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- keccak (crates.io): affected all versions; fixed in 0.1.6\n- keccak (crates.io): affected all versions; fixed in 0.1.6\n- keccak (crates.io): affected from 0.0.0-0; fixed in 0.1.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-3288-p39f-rqpv/ (Markdown: https://insights.sbomify.com/GHSA-3288-p39f-rqpv/index.md)","id":"GHSA-3288-p39f-rqpv","markdown":"https://insights.sbomify.com/GHSA-3288-p39f-rqpv/index.md","name":"GHSA-3288-p39f-rqpv","record":{"aliases":["RUSTSEC-2026-0012"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["other"],"network_reachable":"unknown","non_default_config":true,"product_category":"Rust keccak library","requires_auth":"none","summary":"Unsoundness in the opt-in ARMv8 assembly backend of the keccak crate could theoretically lead to memory safety issues, though no practical impact was observed.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nThe `asm!` block enabled by the off-by-default `asm` feature, when enabled on ARMv8 targets, misspecified the operand\ntype for all of its operands, using `in` for pointers and values which were subsequently mutated by operations performed\nwithin the assembly block.\n\n### Impact\n\nIt's unclear what practical impact, if any, this actually had. Incorrect operand types are technically undefined\nbehavior, however changing them had no actual impact on the generated assembly for these targets. The possibility still\nexists that it may lead to potential memory safety or other issues on hypothetical future versions of rustc.\n\n### Mitigation\n\nThe operand types were changed from `in` to `inout`, and the impacted versions of the `keccak` crate were yanked.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Unsoundness in opt-in ARMv8 assembly backend for `keccak`","id":"GHSA-3288-p39f-rqpv","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.1.6"],"introduced":["0"],"last_affected":[],"package":"keccak","purl":null,"source":"GHSA-3288-p39f-rqpv"},{"ecosystem":"crates.io","fixed":["0.1.6"],"introduced":["0"],"last_affected":[],"package":"keccak","purl":"pkg:cargo/keccak","source":"GHSA-3288-p39f-rqpv"},{"ecosystem":"crates.io","fixed":["0.1.6"],"introduced":["0.0.0-0"],"last_affected":[],"package":"keccak","purl":"pkg:cargo/keccak","source":"RUSTSEC-2026-0012"}],"products":null,"published":"2026-02-12","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"open","licence":"CC0 1.0","name":"RustSec","prefix":"RUSTSEC"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unsoundness in the opt-in ARMv8 assembly backend of the keccak crate could theoretically lead to memory safety issues, though no practical impact was observed.","url":"https://insights.sbomify.com/GHSA-3288-p39f-rqpv/"}