GHSA-7vjm-6qgq-3mrq: Shaman has soundness issues and is unmaintained

November 3, 2025

shaman::cryptoutil::write_u64v_le and other functions mentioned above cannot garantee memory safety of get_unchecked later if both length are zero.

shaman is unmaintained.

References

crates.io/crates/shaman
github.com/advisories/GHSA-7vjm-6qgq-3mrq
rustsec.org/advisories/RUSTSEC-2025-0113.html

Code Behaviors & Features

Detect and mitigate GHSA-7vjm-6qgq-3mrq with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →