CVE-2023-42447
blurhash: panic on parsing crafted blurhash inputs
Published Sep 19, 2023 · updated Oct 13, 2026
## Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-8 characters ## Patches The patches were released under version 0.2.0, which may require user intervention because of slight API churn.
Timeline
Detection, updates, and resolution for this record.
Sep 19, 2023 · Catalog
Detected
## Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-8 characters ## Patches The patches were released under version 0.2.0, which may require user interv
Oct 13, 2026 · Catalog
Fix available
crates.io blurhash 0.0.0-0 → 0.2.0
Oct 13, 2026 · Catalog
Updated
## Impact The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input. In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include: - UTF-8 compliant strings containing multi-byte UTF-8 characters ## Patches The patches were released under version 0.2.0, which may require user interv
Affected
- crates.io blurhash0.0.0-0 → 0.2.0
Sources
- CVE.orgCVE-2023-42447
Official CVE identifier
cve.org - FIRST EPSSCVE-2023-42447
30-day exploitation probability 0.6%
first.org - GitHub Advisory DatabaseGHSA-cxvp-82cq-57h2
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devRUSTSEC-2023-0083
blurhash: panic on parsing crafted blurhash inputs
osv.dev