Summary
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics
hubuum_client diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models.
Affected behavior
Native reqwest::Error values retain the full request URL. Converting those errors into ApiError::Http, or exhausting retries and storing the error text in ApiError::RetryExhausted, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided messages, response bodies, or payload details, including through error source chains.
Several public response and model types also derived or implemented diagnostics over untrusted or secret-adjacent fields. These include raw response bodies and cursors; rendered and JSON export payloads; import schemas and object data; task summaries, links, output URLs, events, and import-result details; event-delivery claims and errors; event sink configuration; subscription routing; and remote-call failure details. High-level backup and export runners additionally copied unsuccessful server task summaries into ApiError::Api.
Applications commonly log errors and response values, so credentials, tokens, cursors, filters, echoed request content, imported object data, schema defaults, task or delivery details, and other sensitive payloads can be written to logs even though normal request logging redacts query values.
Validation
Regression coverage exercises direct HTTP conversion, async and blocking retry exhaustion, response and decoding diagnostics, import/export/raw-response containers, unsuccessful async and blocking task runners, task/event/import-result models, and secret-bearing event and remote models. The workspace format, lint, documentation, test, feature-matrix, Rust 1.88 MSRV, OpenAPI validation, release-metadata, and combined library plus consumer integration suites pass against the immutable Hubuum 0.0.3 image.
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The proposed fix redacts query values from embedded request URLs before storing native HTTP errors and applies the same sanitization to exhausted retries. Default error and model diagnostics now report safe metadata rather than server messages, payloads, cursors, links, configuration, or secret-adjacent details. JSON codec errors no longer appear in the standard source chain, and unsuccessful high-level backup/export operations use the structured TaskUnsuccessful variant without copying task summaries.
Explicit response, error, task, import, export, event, and delivery APIs continue to expose original values for applications that deliberately inspect them.
Frequently Asked Questions
- What is GHSA-2625-RW7M-5Q5X? GHSA-2625-RW7M-5Q5X is a low-severity security vulnerability in hubuum_client (rust), affecting versions <= 0.6.0. It is fixed in 0.6.1.
- Which versions of hubuum_client are affected by GHSA-2625-RW7M-5Q5X? hubuum_client (rust) versions <= 0.6.0 is affected.
- Is there a fix for GHSA-2625-RW7M-5Q5X? Yes. GHSA-2625-RW7M-5Q5X is fixed in 0.6.1. Upgrade to this version or later.
- Is GHSA-2625-RW7M-5Q5X exploitable, and should I be worried? Whether GHSA-2625-RW7M-5Q5X is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-2625-RW7M-5Q5X is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-2625-RW7M-5Q5X? Upgrade
hubuum_clientto 0.6.1 or later.