NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🦀 crates.io
Not in CISA KEV

anon-vec lacks sufficient checks in public APIGHSA-pr59-jjr4-gcf6

GHSA-pr59-jjr4-gcf6 is a security vulnerability in anon-vec. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Also known asRUSTSEC-2025-0039
Published
Updated
Affected
1 pkg
Patched
None yet
Exploits
None indexed
Exploitation data as of Oct 28, 2025 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🦀anon-vec

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

The following functions in the anon-vec crate are unsound due to insufficient checks on their arguments::

  • AnonVec::get_ref()
  • AnonVec::get_mut()
  • AnonVec::remove_get()

The crate was built as a learning project and is not being maintained.

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
🦀crates.ioanon-vecall versionsNo fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for anon-vec, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    The records we use list no patched version of anon-vec for GHSA-pr59-jjr4-gcf6. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

  3. Mitigate without a patch

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

The following functions in the anon-vec crate are unsound due to insufficient checks on their arguments:: - `AnonVec::get_ref()` - `AnonVec::get_mut()` - `AnonVec::remove_get()` The crate was built as a learning project and is not being maintained.
O3 Security · Impact-Aware SCA

Is GHSA-pr59-jjr4-gcf6 in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works
anon-vec lacks sufficient checks in public API