~ / search / GHSA-6mw6-mj76-grwc

GHSA-6mw6-mj76-grwc

gix-date can create non-utf8 string with `TimeBuf::as_str`

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-0810

Packages

EcosystemPackageAffectedFixed in
crates.io gix-date < 0.12.0 0.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

The function `gix_date::parse::TimeBuf::as_str` can create an illegal string containing non-utf8 characters. This violates the safety invariant of `TimeBuf` and can lead to undefined behavior when consuming the string. The bug can be prevented by adding `str::from_utf8` to the function `TimeBuf::write`.

References

External links from the advisory. They lead to third-party sites.