crates.io columnar vulnerabilities

Latest crates.io columnar CVEs

Newest publication first

1. GHSA-cxcc-q839-2cw9 columnar: `Read` on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())

   Published 2022-06-16

   Unknown

   Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (ColumnarReadExt::read_typed_vec()). Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written...

2. CVE-2021-45685 columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())

   Published 2021-12-26

   Critical·CVSS 9.8 EPSS 1.2%

   An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.