V OpenVet
Packages Docs Blog Sign in
cargo / bincode

bincode

cargo

A binary serialization / deserialization strategy for transforming structs into bytes and vice versa!

1 audit github.com/bincode-org/bincode

Audits

PE Patrick Elsen 2026-05-27

bincode@1.3.3 · 3 findings

bincode 1.3.3 (final serde-based release): three findings — medium memory-exhaustion vector via default deserialize options on untrusted input (mitigate with .with_limit(N)), medium unmaintained status (development ceased 2025), low 2015-era unsafe pointer-cast idioms in vendored byteorder.rs. Six unsafe blocks, all sound. Safe to deploy for trusted input or with explicit limits.

has-binarieshas-build-exechas-fuzz-testshas-install-exechas-integration-testshas-property-testshas-unit-testsimpl-algorithmimpl-concurrencyimpl-cryptoimpl-datastructureimpl-interpreterimpl-jitimpl-parserimpl-protocolis-benignparser-impl-correctparser-impl-safeparser-impl-testedprotocol-impl-correctprotocol-impl-safeprotocol-impl-testedunsafe-documentedunsafe-minimalunsafe-safeunsafe-testeduses-concurrencyuses-cryptouses-environmentuses-execuses-filesystemuses-interpreteruses-jituses-networkuses-unsafe

Package facts

Registry
cargo
Repository
github.com/bincode-org/bincode
V openvet · supply-chain audits · open source
CLI Source