GHSA-rc23-xxgq-x27g wee_alloc is Unmaintained
The wee_alloc crate is unmaintained and may cause memory leaks, prompting users to switch to the default Rust allocator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-rc23-xxgq-x27g?
GHSA-rc23-xxgq-x27g is a vulnerability in wee_alloc, published on 11 May 2022.
Official description
Two of the maintainers have indicated that the crate may not be maintained.
The crate has open issues including memory leaks and may not be suitable for production use.
It may be best to switch to the default Rust standard allocator on wasm32 targets.
Last release seems to have been three years ago.
Possible Alternative(s)
The below list has not been vetted in any way and may or may not contain alternatives;
- Rust standard default allocator on wasm32-target
Honorable Mention(s)
The below may serve to educate on potential future alternatives:
Which versions are affected by GHSA-rc23-xxgq-x27g?
3 open source packages ship an affected version, including wee_alloc.
| Package | Affected | Fixed in |
|---|---|---|
wee_alloc crates.io | All versions | None |
wee_alloc crates.io | All versions | None |
wee_alloc crates.io | From 0.0.0-0 | None |
How do I fix GHSA-rc23-xxgq-x27g?
No fix has been published for GHSA-rc23-xxgq-x27g yet. Limit exposure of the affected software until one is available.
Is GHSA-rc23-xxgq-x27g being exploited?
There is no known exploitation of GHSA-rc23-xxgq-x27g in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2022-0054.