GHSA-qwgh-2vcv-g2f7: block_buffer: panic corrupts inline buffer position

August 19, 2026

A caught panic may leave the cursor position of EagerBuffer or ReadBuffer in a corrupted state; this in turn allows out-of-bounds reads/writes.

References

github.com/RustCrypto/utils/releases/tag/block-buffer-v0.12.1
github.com/RustCrypto/utils/security/advisories/GHSA-qwgh-2vcv-g2f7
github.com/advisories/GHSA-qwgh-2vcv-g2f7

Code Behaviors & Features

Detect and mitigate GHSA-qwgh-2vcv-g2f7 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →