CVE-2023-28448

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

• CWE-125
• CWE-125

• https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47Patch, Third Party Advisory
• https://github.com/firecracker-microvm/versionize/pull/53Third Party Advisory
• https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvcThird Party Advisory
• https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47Patch, Third Party Advisory
• https://github.com/firecracker-microvm/versionize/pull/53Third Party Advisory
• https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvcThird Party Advisory

Published

Mar 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28442GeoNode is an open source platform that facilitates the crea…5.3
• CVE-2023-28443Directus is a real-time API and App dashboard for managing S…5.5
• CVE-2023-28444angular-server-side-configuration helps configure an angular…7.5
• CVE-2023-28445Deno is a runtime for JavaScript and TypeScript that uses V8…9.8
• CVE-2023-28446Deno is a simple, modern and secure runtime for JavaScript a…8.8
• CVE-2023-28447Smarty is a template engine for PHP. In affected versions sm…6.1
• CVE-2023-2845Improper Access Control in GitHub repository cloudexplorer-d…8.1
• CVE-2023-28450An issue was discovered in Dnsmasq before 2.90. The default …7.5
• CVE-2023-28451An issue was discovered in Technitium 11.0.2. There is a vul…7.5
• CVE-2023-28452An issue was discovered in CoreDNS through 1.10.1. There is …7.5
• CVE-2023-28455An issue was discovered in Technitium through 11.0.2. The fo…7.5
• CVE-2023-28456An issue was discovered in Technitium through 11.0.2. It ena…7.5