Repository navigation
Insecure Deserialization and Memory-Based Confusion Attacks in Boost Serialization #331
Description
An issue was discovered in Boost Serialization v1.89.0 and below. Insecure deserialization of untrusted input under certain conditions may lead to type confusion and ownership confusion, -- redacted --.
-- details redacted temporarily, discussion with maintainers ongoing --
Activity
gennaroprota commentedon Aug 18, 2026
Apologies for the long silence on this. I have recently taken over maintenance of Boost.Serialization, and would like to assess and fix it.
Until now, there was no private reporting channel for this library. I have now enabled GitHub's private vulnerability reporting, so please file the details there:
https://github.com/boostorg/serialization/security/advisories/new.
Thank you for holding the details back and for your patience.