{"id":"GHSA-5w5r-mf82-595p","aliases":["RUSTSEC-2025-0143"],"url":"https://o3.security/vulnerability/GHSA-5w5r-mf82-595p","summary":"Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema","details":"The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas.\n\n## `Reader::get`\n\n```rust\npub fn get(&self) -> Result<<T as Owned>::Reader<'static>> {\n    // ...\n    // UNSAFE: access `words` without validation\n}\n```\n\n## `StructSchema::new`\n\n```rust\npub fn new(builder: RawBrandedStructSchema) -> StructSchema {\n    // ...\n    // UNSAFE: access encoded nodes without validation\n}\n```\n\nThis vulnerability allows safe Rust code to trigger UB, which violates Rust's safety guarantees.\n\nThe issue is resolved in version `0.24.0` by making constructor functions unsafe and mark the fields of struct as visible only in the crate.","published":"2026-01-28T16:06:09Z","modified":"2026-02-03T03:06:53.944791Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"capnp","fixedVersion":"0.24.0"}],"fix":{"url":"https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf","label":"capnproto/capnproto-rust@7b981f4"},"references":[{"type":"WEB","url":"https://github.com/capnproto/capnproto-rust/issues/605"},{"type":"WEB","url":"https://github.com/capnproto/capnproto-rust/commit/7b981f4c75a975c80444cd38729bcdf12bf3eabf"},{"type":"WEB","url":"https://github.com/capnproto/capnproto-rust/commit/e3aeec213e6d1b30a182bf61682a370f20d8a02c"},{"type":"PACKAGE","url":"https://github.com/capnproto/capnproto-rust"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2025-0143.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-03T03:06:53.944791Z"}}