cargo package report

Is faster-hex safe?

1 known vulnerability.

// reach

0 direct dependencies

none carry a known advisory

    0 packages depend on it

    an advisory here reaches each of them

      Create a free accountfor every dependency path, dependent and what to upgrade
      // ai model usage

      Tracked for PyPI packages. HuggingFace models declare Python dependencies, so cargo packages are not covered.

      cvss
      not scored

      severity out of 10

      epss
      not scored

      chance of exploitation in 30 days

      xyz score
      not scored

      CyberXYZ composite out of 10

      fig. 01 — RUSTSEC-2026-0306, the advisory selected below

      // 1 advisories

      RUSTSEC-2026-0306

      UNKNOWN

      fasterhex::hexdecodeunchecked is a safe function. On x86 and x8664, when AVX2 is enabled, hexdecodeavx2 keeps decoding while dst.len() >= 32 and then loads 32 bytes from src and 32 bytes from src[32..]. Nothing in that loop requires src to contain 64 bytes.

      A safe caller can pass a short src and a dst of at least 32 bytes. The AVX2 load then reads outside src.

      The function has had this shape since 0.3.0. 0.10.0 is the last release with the unbounded AVX2 read. The maintainer agreed to this advisory and shipped the backport in 0.10.1 (pull request 74): the AVX2 loop now requires src.len() >= 64 before those loads. 1.0.0 rewrites hexdecodeunchecked so the decoded length is min(src.len() / 2, dst.len()). Both are covered by >= 0.10.1. Other architectures take the scalar fallback and are outside this advisory.

      Checked 2026-09-24 at 08:33 UTC. The most recent advisory here was published 2026-09-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.

      Think a verdict here is wrong? Tell us — we respond within 2 business days.
      Is faster-hex safe? cargo package security report | CyberXYZ