{"id":"GHSA-f95p-4cv5-8w8x","aliases":["RUSTSEC-2024-0407"],"url":"https://o3.security/vulnerability/GHSA-f95p-4cv5-8w8x","summary":"linkme fails to ensure slice elements match the slice's declared type","details":"Affected versions allow populating a DistributedSlice of T with elements of an arbitrary other type that coerces to T. For example, elements of type `&&str` could end up in a slice of type `[&str]`, since `&&str` coerces to `&str` via a deref coercion.\n\nThe flaw was corrected by implementing typechecking for distributed slice elements in such a way that coercion no longer occurs. The element's type must be a subtype of the slice's declared element type.","published":"2024-12-04T18:26:13Z","modified":"2025-10-28T06:29:24.336519Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"linkme","fixedVersion":"0.3.24"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/dtolnay/linkme/issues/82"},{"type":"PACKAGE","url":"https://github.com/dtolnay/linkme"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0407.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-10-28T06:29:24.336519Z"}}