What is GHSA-FJX5-QPF4-XJF2?

GHSA-FJX5-QPF4-XJF2 is a medium-severity security vulnerability in borsh (rust), affecting versions <= 0.10.3. It is fixed in 1.0.0-alpha.1.

Which versions of borsh are affected by GHSA-FJX5-QPF4-XJF2?

borsh (rust) versions <= 0.10.3 is affected.

Is there a fix for GHSA-FJX5-QPF4-XJF2?

Yes. GHSA-FJX5-QPF4-XJF2 is fixed in 1.0.0-alpha.1. Upgrade to this version or later.

Is GHSA-FJX5-QPF4-XJF2 exploitable, and should I be worried?

Whether GHSA-FJX5-QPF4-XJF2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-FJX5-QPF4-XJF2 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-FJX5-QPF4-XJF2 in borsh

Q: Which versions of borsh are affected by GHSA-FJX5-QPF4-XJF2?

borsh (rust) versions <= 0.10.3 is affected.

Q: Is there a fix for GHSA-FJX5-QPF4-XJF2?

Yes. GHSA-FJX5-QPF4-XJF2 is fixed in 1.0.0-alpha.1. Upgrade to this version or later.

Q: Is GHSA-FJX5-QPF4-XJF2 exploitable, and should I be worried?

Whether GHSA-FJX5-QPF4-XJF2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-FJX5-QPF4-XJF2 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-FJX5-QPF4-XJF2?

Upgrade borsh to 1.0.0-alpha.1 or later.

Summary

Parsing borsh messages with ZST which are not-copy/clone is unsound

Affected versions of borsh cause undefined behavior when zero-sized-types (ZST) are parsed and the Copy/Clone traits are not implemented/derived. For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy (this can be achieved through a singleton), then accessing/writing to deserialized data will cause a segmentation fault.

There is currently no way for borsh to read data without also providing a Rust type. Therefore, if you are not using ZST for serialization, then you are not affected by this issue.

Impact

Affected versions

borsh (<= 0.10.3)

Security releases

borsh → 1.0.0-alpha.1 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade borsh to 1.0.0-alpha.1 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-FJX5-QPF4-XJF2? GHSA-FJX5-QPF4-XJF2 is a medium-severity security vulnerability in borsh (rust), affecting versions <= 0.10.3. It is fixed in 1.0.0-alpha.1.
Which versions of borsh are affected by GHSA-FJX5-QPF4-XJF2? borsh (rust) versions <= 0.10.3 is affected.
Is there a fix for GHSA-FJX5-QPF4-XJF2? Yes. GHSA-FJX5-QPF4-XJF2 is fixed in 1.0.0-alpha.1. Upgrade to this version or later.
Is GHSA-FJX5-QPF4-XJF2 exploitable, and should I be worried? Whether GHSA-FJX5-QPF4-XJF2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-FJX5-QPF4-XJF2 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-FJX5-QPF4-XJF2? Upgrade borsh to 1.0.0-alpha.1 or later.