GHSA-6g2r-675j-hx59 xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
A safe API in xxhash-rust accepts short secrets, causing undefined behavior and potential crashes or code execution in release builds.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6g2r-675j-hx59?
GHSA-6g2r-675j-hx59 is a memory corruption vulnerability in xxhash-rust, published on 2 Oct 2026.
Official description
I have a minimized safe Rust witness for xxhash-rust 0.8.15.
Safe public route:
xxhash_rust::xxh3::xxh3_64_with_secret(&[0x41], &[])
The caller-side harness contains no unsafe code. Under release execution, the internal minimum custom-secret length predicate is enforced only by debug_assert!. Release-Miri reports construction of a fixed-width reference beyond the empty secret allocation.
Observed diagnostic:
Undefined Behavior: constructing invalid value of type &[u8; 4]: encountered a dangling reference
Local repair evidence: handling custom-secret slices shorter than the internal minimum before fixed-width secret reads makes the same safe short-secret harness pass under Linux release-Miri.
Local artifacts:
- vulnerable log: artifacts/logs/W-4332_xxhash_rust_short_secret_miri_release_linux_001.log
- repair log: artifacts/logs/differentials/W-4332_xxhash_rust_local_repair_miri_release_linux_001.log
- report: artifacts/reports/W-4332_xxhash_rust_short_secret_report.md
Which versions are affected by GHSA-6g2r-675j-hx59?
2 open source packages ship an affected version, including xxhash-rust.
| Package | Affected | Fixed in |
|---|---|---|
xxhash-rust crates.io | All versions | 0.8.16 |
xxhash-rust crates.io | All versions | 0.8.16 |
How do I fix GHSA-6g2r-675j-hx59?
Upgrade xxhash-rust to 0.8.16 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-6g2r-675j-hx59 being exploited?
There is no known exploitation of GHSA-6g2r-675j-hx59 in the wild and no public exploit code.