Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0184

Potential undefined behavior with Signature from a buffer-created BlameHunk

Published May 13, 2026 · Updated Jun 17, 2026 · Assigned by RUSTSEC

Description

When a `Blame` is created via `Blame::blame_buffer()`, and a `BlameHunk` is retrieved, the pointers to the original author, original committer, final author, and final committer may be null if unavailable. The corresponding `BlameHunk` methods then create `Signature`s based on null pointers; attempting to access the data of the `Signature`s leads to dereferencing null pointers.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io git2 >= 0.0.0-0, < 0.21.0 0.21.0 RUSTSEC-2026-0184

References