rkyv vulnerabilities
CVEs whose affected-version data names the rkyv package (rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
RUSTSEC-2026-0235NoneInsufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
▾ Sunlitrkyv · rkyvvia OSV
RUSTSEC-2026-0234NoneInsufficient archive validation can cause out-of-bounds reads in archives containing hash tables
Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
▾ Sunlitrkyv · rkyvvia OSV
RUSTSEC-2026-0233NoneCrafted archives can cause a use-after-free during deserialization
Crafted archives can cause a use-after-free during deserialization
▾ Sunlitrkyv · rkyvvia OSV