GHSA-2wq5-g96f-mv3v — ouch
GHSA-2wq5-g96f-mv3v is a security vulnerability in ouch. A fix is available for ouch — see the affected versions and patch details below.
Ouch! allows a segmentation fault due to use of uninitialized memory
Real-World Exposure
ouchReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convert_zip_date_time". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the uninitialized memory region. After that, when other function tries to dereference "month", segmentation fault occurs.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | ouch | all versions | 0.3.1cargo update -p ouch --precise 0.3.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ouch, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update ouch to 0.3.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2wq5-g96f-mv3v is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-2wq5-g96f-mv3v can be triaged on real exposure rather than presence alone.
Tailored to GHSA-2wq5-g96f-mv3v. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-2wq5-g96f-mv3v in your dependencies?
O3 Security finds GHSA-2wq5-g96f-mv3v across crates.io dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.