<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>https://db.gcve.eu/rss/recent/all/10</id>
  <title>Most recent entries from all</title>
  <updated>2026-11-08T16:04:26.567883+00:00</updated>
  <author>
    <name>Vulnerability-Lookup</name>
    <email>info@gcve.eu</email>
  </author>
  <link href="https://db.gcve.eu" rel="alternate"/>
  <generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator>
  <subtitle>Contains only the most 10 recent entries.</subtitle>
  <entry>
    <id>https://db.gcve.eu/vuln/rustsec-2025-0068</id>
    <title>RUSTSEC-2025-0068 — serde_yml crate is unsound and unmaintained</title>
    <updated>2026-11-08T16:04:26.568806+00:00</updated>
    <content type="xhtml">
      <div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Affected:</strong> crates.io: serde_yml</p>
<p>Using `serde_yml::ser::Serializer.emitter` can cause a segmentation fault, which is unsound.</p>
<p>The GitHub project for `serde_yml` was archived after unsoundness issues were raised.</p>
<p>If you rely on this crate, it is highly recommended switching to a maintained alternative.</p>
<p>## Recommended alternatives</p>
<p>- [`serde_norway`](https://crates.io/crates/serde_norway) - Maintained fork of `serde_yaml`, using `unsafe-libyaml-norway`
- [`serde_yaml_ng`](https://crates.io/crates/serde_yaml_ng) - Maintained fork of `serde_yaml`, using unmaintained `unsafe-libyaml`</p>
<p>## Incomplete pure Rust alternatives</p>
<p>These implementation do not rely on C `libyaml`.</p>
<p>- [`serde_yaml2`](https://crates.io/crates/serde_yaml2)
- [`yaml-peg`](https://crates.io/crates/yaml-peg)</p></div>
    </content>
    <link href="https://db.gcve.eu/vuln/rustsec-2025-0068"/>
  </entry>
</feed>
