Skip to content

RUSTSEC-2026-0183: Potential undefined behavior when calling Remote::list() #469

Description

@github-actions

Potential undefined behavior when calling Remote::list()

Details
Status unsound
Package git2
Version 0.20.4
URL rust-lang/git2-rs#1250
Date 2026-05-12

When calling Remote::list() for a remote of a git repository, when that remote does not advertise any references, git2 passes a null pointer to the unsafe function slice::from_raw_parts(). Based on the safety section documentation of function, data must be non-null even for slices of length zero. Thus, the use of a null pointer leads to undefined behavior.

See advisory page for additional details.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions