Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🦀 crates.io
Not in CISA KEV

Unexpected panics in num-bigintGHSA-v935-pqmr-g8v9

Fix: rust-num/num-bigint#228

GHSA-v935-pqmr-g8v9 is a security vulnerability in num-bigint. A fix is available for num-bigint — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 3, 2021 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🦀num-bigint

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Two scenarios were reported where BigInt and BigUint multiplication may unexpectedly panic.

  • The internal mac3 function did not expect the possibility of non-empty all-zero inputs, leading to an unwrap() panic.
  • A buffer was allocated with less capacity than needed for an intermediate result, leading to an assertion panic.

Rust panics can either cause stack unwinding or program abort, depending on the application configuration. In some settings, an unexpected panic may constitute a denial-of-service vulnerability.

Patches

Both problems were introduced in version 0.4.1, and are fixed in version 0.4.3.

For more information

If you have any questions or comments about this advisory, please open an issue in the num-bigint repo.

Acknowledgements

Thanks to Guido Vranken and Arvid Norberg for privately reporting these issues to the author.

References

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🦀crates.ionum-bigint≥ 0.4.1&&< 0.4.30.4.3cargo update -p num-bigint --precise 0.4.3

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for num-bigint, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update num-bigint to 0.4.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v935-pqmr-g8v9 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic. - The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic. - A buffer was allocated with less capacity than needed for an intermediate result, leading to an assertion panic. Rust panics can either cause stack unwinding or program abort, depending on the application configuration. In some settings, an unexpected panic may constitute a denial-of-service vulnerability. ### Patches Both problems were introduced in version 0.
O3 Security · Impact-Aware SCA

Is GHSA-v935-pqmr-g8v9 in your dependencies?

Find it across crates.io, including transitive dependencies.

Scan my dependencies How O3 SCA works
Unexpected panics in num-bigint