GHSA-6mw6-mj76-grwcMedium

gix-date can create non-utf8 string with `TimeBuf::as_str`

Published
January 5, 2026
Last Modified
January 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-0810 →

📋 Description

The function gix_date::parse::TimeBuf::as_str can create an illegal string containing non-utf8 characters. This violates the safety invariant of TimeBuf and can lead to undefined behavior when consuming the string.

The bug can be prevented by adding str::from_utf8 to the function TimeBuf::write.

🎯 Affected products1

  • rust/gix-date:< 0.12.0

🔗 References (8)