Advisories for Cargo/Rand package

2026

Rand is unsound with a custom logger using rand::rng()

It has been reported (by @lopopolo) that the rand library is unsound (i.e. that safe code using the public API can cause Undefined Behaviour) when all the following conditions are met: The log and thread_rng features are enabled A custom logger is defined The custom logger accesses rand::rng() (previously rand::thread_rng()) and calls any TryRng (previously RngCore) methods on ThreadRng The ThreadRng (attempts to) reseed while called from the custom logger …