How severe is GHSA-g23h-7vf9-xc25?

No CVSS score has been assigned to GHSA-g23h-7vf9-xc25 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-g23h-7vf9-xc25?

GHSA-g23h-7vf9-xc25 affects the following packages: mimalloc (crates.io). Ecosystems affected: crates.io.

How do I fix GHSA-g23h-7vf9-xc25?

Update mimalloc to 0.1.39 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g23h-7vf9-xc25 is resolved across your whole dependency graph.

How do I detect GHSA-g23h-7vf9-xc25 in my crates.io dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mimalloc, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-g23h-7vf9-xc25 if there is no patch (or I can't update yet)?

Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Is GHSA-g23h-7vf9-xc25 actively exploited in the wild?

No public exploit code has been indexed for GHSA-g23h-7vf9-xc25 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-g23h-7vf9-xc25 published, and has it been updated?

GHSA-g23h-7vf9-xc25 was published on November 12, 2024 and was last updated on September 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

Mimalloc Can Allocate Memory with Bad Alignment

Real-World Exposure

1 pkg affected

🦀mimalloc

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons. Since then, the mimalloc allocator's logic changed, making it break this promise. This caused this crate to return memory with an incorrect alignment for some allocations, particularly those with large alignments. The flaw was fixed by always using the aligned allocation functions.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🦀crates.io	`mimalloc`	all versions	0.1.39`cargo update -p mimalloc --precise 0.1.39`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mimalloc, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update mimalloc to 0.1.39 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g23h-7vf9-xc25 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons. Since then, the mimalloc allocator's logic changed, making it break this promise. This caused this crate to return memory with an incorrect alignment for some allocations, particularly those with large alignments. The flaw was fixed by always using the aligned allocation functions.

O3 Security · Impact-Aware SCA

Is GHSA-g23h-7vf9-xc25 in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works

Mimalloc Can Allocate Memory with Bad AlignmentGHSA-g23h-7vf9-xc25