{"id":"RUSTSEC-2026-0220","title":"Uint shift operations: incorrect overflow flags and truncated shift amounts","summary":"Uint shift operations: incorrect overflow flags and truncated shift amounts","severity":"none","vendor":"ruint","product":"ruint","ecosystem":"rust","affected":["ruint >= 0.0.0-0, < 1.20.0"],"patched":["ruint 1.20.0"],"published":"2026-07-08","updated":"2026-07-30","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0220","references":[{"url":"https://crates.io/crates/ruint"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0220.html"},{"url":"https://github.com/alloy-rs/ruint/pull/603"}],"tags":["osv","rust"],"ingestedAt":"2026-07-31T19:10:08.259Z","slug":"RUSTSEC-2026-0220","body":"## Overview\n\n`Uint::overflowing_shl`/`overflowing_shr` returned false-negative overflow\nflags. `overflowing_shl` missed bits shifted above `BITS` but within the top\nlimb (non-limb-aligned widths such as `U160`), and limbs wholly discarded by\nshifts >= 64; `overflowing_shr` missed wholly discarded low limbs. Shifted\nvalues were correct; only the flag was wrong.\n\nThe wrong flag propagates: `checked_shl`/`checked_shr` return `Some` instead\nof `None`, `strict_*` fail to panic, and `saturating_*` return a wrapped\nvalue instead of saturating. The incorrect `checked_shl` result causes\n`to_base_be` (and string formatting) to loop forever on no-alloc builds for\nnon-limb-aligned widths — a denial of service if formatting is reachable\nfrom untrusted input.\n\nSeparately, `wrapping_shl`/`wrapping_shr` on 64/128/256-bit types truncated\nthe shift amount modulo 2^32, so shifts >= 2^32 returned an incorrectly\nwrapped value instead of zero; on 32-bit targets the generic path also\ntruncated 64-bit shift amounts.\n\nCallers using checked or saturating shift semantics on untrusted shift\namounts may compute incorrect results.\n\n## Affected packages\n\n- `ruint >= 0.0.0-0, < 1.20.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ruint 1.20.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}