Reported

September 11, 2025

Issued

September 12, 2025 (last modified: October 28, 2025)

Package

libyml (crates.io)

Type

INFO Unsound

Aliases

• GHSA-gfxp-f68g-8x78

References

• https://github.com/rustsec/advisory-db/issues/2395

Patched

no patched versions

Description

In version 0.0.4, libyml::string::yaml_string_extend was revised resulting in undefined behaviour, which is unsound.

The GitHub project for libyml was archived after unsoundness issues were raised.

If you rely on this crate, it is highly recommended switching to a maintained alternative.

Recommended alternatives

• libyaml-safer
• unsafe-libyaml-norway - Maintained fork of unsafe-libyaml

Advisory available under CC0-1.0 license.