GHSA-m2xr-2vj4-wh94 tanton_engine has unsound public API
Unsound public APIs in the unmaintained tanton_engine crate allow memory corruption, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-m2xr-2vj4-wh94?
GHSA-m2xr-2vj4-wh94 is a memory corruption vulnerability in tanton_engine, published on 24 Apr 2025.
Official description
The following functions in the tanton_engine crate are unsound due to lack of sufficient boundary
checks in public API:
Stack::offset()ThreadStack::get()RootMoveList::insert_score_depth()RootMoveList::insert_score()
The tanton_engine crate is no longer maintained, so there are no plans to fix this issue.
Which versions are affected by GHSA-m2xr-2vj4-wh94?
3 open source packages ship an affected version, including tanton_engine.
| Package | Affected | Fixed in |
|---|---|---|
tanton_engine crates.io | All versions to 1.0.0 | None |
tanton_engine crates.io | All versions to 1.0.0 | None |
tanton_engine crates.io | From 0.0.0-0 | None |
How do I fix GHSA-m2xr-2vj4-wh94?
No fix has been published for GHSA-m2xr-2vj4-wh94 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-m2xr-2vj4-wh94 being exploited?
There is no known exploitation of GHSA-m2xr-2vj4-wh94 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0031.