crates.io/rkyv

rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution

Modified: 9/10/2026

Use of uninitialized buffer in rkyv

Modified: 11/8/2023

Archives may contain uninitialized memory

Modified: 11/8/2023

Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM

Modified: 1/6/2026

Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`

Modified: 5/16/2026

Crafted archives can cause a use-after-free during deserialization

Modified: 8/4/2026

Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables

Modified: 8/4/2026

Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc

Modified: 8/4/2026