GHSA-7vjm-6qgq-3mrq: 
Rust vulnerability analysis and mitigation

The vulnerability (GHSA-7vjm-6qgq-3mrq) affects the Shaman crate, a Rust package, and was discovered in version 0.1.0 and earlier versions. The issue was reported on May 6, 2025, and officially published to the GitHub Advisory Database on November 3, 2025. This vulnerability is classified as a soundness issue in the package's cryptographic utility functions (RustSec Advisory, GitHub Advisory).

The vulnerability specifically affects multiple cryptographic utility functions in the Shaman crate, including writeu64vle, readu32vbe, readu32vle, readu64vbe, readu64vle, and writeu32vle. These functions contain a memory safety issue where they cannot guarantee the safety of get_unchecked operations when both lengths are zero. The vulnerability has been assigned a low severity rating (GitHub Advisory).

The vulnerability presents memory corruption risks due to soundness issues in the cryptographic utility functions. The impact is particularly concerning as the package is now unmaintained, leaving users without official support or security updates (RustSec Advisory).

Currently, there are no patched versions available for this vulnerability. Given that the package is unmaintained, users are advised to consider alternative maintained cryptographic libraries for their projects (RustSec Advisory).