{"id":"RUSTSEC-2026-0294","aliases":["GHSA-8mq4-3mwq-qvg6"],"title":"Unsoundness in UTF-8 'String' trait","summary":"Unsoundness in UTF-8 'String' trait","severity":"none","vendor":"iceoryx2-bb-container","product":"iceoryx2-bb-container","ecosystem":"rust","affected":["iceoryx2-bb-container >= 0.11.0-0, < 0.10.0"],"patched":["iceoryx2-bb-container 0.10.0"],"published":"2026-09-18","updated":"2026-09-21","sourceUpdated":"2026-09-21T09:45:03.168416810Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0294","references":[{"url":"https://crates.io/crates/iceoryx2-bb-container"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0294.html"},{"url":"https://github.com/eclipse-iceoryx/iceoryx2/pull/1956"}],"tags":["osv","rust"],"ingestedAt":"2026-09-21T16:06:16.786Z","slug":"RUSTSEC-2026-0294","body":"## Overview\n\nThe String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. \nAn application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.\n\nThe API methods `as_mut_bytes` and `deref_mut` where removed from the String API and their implementations (PolymorphicString, RelocatableString, and StaticString ) without replacement.\nLink to Pull-Request: https://github.com/eclipse-iceoryx/iceoryx2/pull/1956\n\n## Affected packages\n\n- `iceoryx2-bb-container >= 0.11.0-0, < 0.10.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `iceoryx2-bb-container 0.10.0`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}