{"id":"GHSA-mrrw-grhq-86gf","aliases":["RUSTSEC-2023-0015"],"title":"Ascii (crate) allows out-of-bounds array indexing in safe code","summary":"Ascii (crate) allows out-of-bounds array indexing in safe code","severity":"medium","vendor":"ascii","product":"ascii","ecosystem":"rust","affected":["ascii >= 0.7.0, < 0.9.3"],"patched":["ascii 0.9.3"],"published":"2023-02-28","updated":"2026-07-16","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mrrw-grhq-86gf","references":[{"url":"https://github.com/tomprogrammer/rust-ascii/issues/64"},{"url":"https://github.com/tomprogrammer/rust-ascii/pull/63/commits/8a6c7798c202766bd57d70fb8d12739dd68fb9dc"},{"url":"https://github.com/tomprogrammer/rust-ascii"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0015.html"}],"tags":["osv","rust"],"ingestedAt":"2026-07-17T19:00:51.576Z","slug":"GHSA-mrrw-grhq-86gf","body":"## Overview\n\nAffected version of this crate had implementation of `From<&mut AsciiStr>` for `&mut [u8]` and `&mut str`. This can result in out-of-bounds array indexing in safe code.\n\nThe flaw was corrected in commit [8a6c779](https://github.com/tomprogrammer/rust-ascii/pull/63/commits/8a6c7798c202766bd57d70fb8d12739dd68fb9dc) by removing those impls.\n\n## Affected packages\n\n- `ascii >= 0.7.0, < 0.9.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ascii 0.9.3`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}