AIKIDO-2026-573777
zerovec-derive is vulnerable to Improper Input Validation
81
High Risk
This Affects:
zerovec-deriveTL;DR
The #[derive(ULE)] macro generates a validate_bytes function that gates zero-copy reinterpretation of an untrusted byte slice as a typed element slice. For multi-element buffers the generated validation loop re-checks only the first element and skips the remaining elements. Malformed bit patterns in later elements pass validation, so unsafe code can interpret invalid bytes as types with restricted validity such as enums or char, causing undefined behavior. The fix validates every element in the buffer.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use #[derive(ULE)] on a type with restricted-validity fields (such as enums or char) and validate untrusted multi-element byte buffers with it.
Background info
zerovec-derive is vulnerable to Improper Input Validation in versions 0.0.1 - 0.10.3 and 0.11.0 - 0.11.4.
How to fix this
Upgrade the zerovec-derive library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant