AIKIDO-2025-10187
alloy-primitives is vulnerable to Undefined Behavior
35
Low Risk
This Affects:
alloy-primitivesTL;DR
Affected versions of this package generate random FixedBytes primitives incorrectly by calling assume_init on an uninitialized array, leading to immediate undefined behavior. Since an uninitialized byte array is always invalid in Rust, this violates safety rules. The fix ensures that every element is properly written to before calling assume_init, using MaybeUninit<u8>; N and leveraging getrandom for safe randomization. For rand, a manual implementation of the Fill trait via a wrapper is used.
Who does this affect?
You are affected if you are using a version which is within vulnerability ranges and using template::UriTemplateStr.
Background info
alloy-primitives is vulnerable to Undefined Behavior in versions 0.1.0 - 0.8.24.
How to fix this
Upgrade the alloy-primitives library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant