[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
rustix	dev-dependencies	patch	1.1.5 → 1.1.6
rustix	dependencies	patch	1.1.5 → 1.1.6

---

xattr functions mark unwritten bytes as initialized when given a zero-length buffer

GHSA-jh2m-fhpj-3vr7 / RUSTSEC-2026-0486

More information

Details

The extended-attribute functions in rustix::fs (getxattr, lgetxattr, fgetxattr, listxattr, llistxattr and flistxattr) write into a Buffer and then mark as many bytes initialized as the system call reported. When the buffer has zero length, the operating system treats the call as a size query: it writes nothing and returns the size of the attribute value or of the name list. rustix still marked that many bytes as initialized.

Passing a Vec whose length equals its capacity through spare_capacity gives such a zero-length buffer, and rustix then set the vector's length past its capacity over memory that was never written. This is undefined behavior reachable from safe code. With an empty &mut [MaybeUninit<u8>] the call panics instead.

From 1.1.6 these functions return an empty result for a zero-length buffer, and new getxattr_query, lgetxattr_query, fgetxattr_query, listxattr_query, llistxattr_query and flistxattr_query functions return the size. The 0.38 series did not have the Buffer API and is not affected.

Severity

Unknown

References

• https://crates.io/crates/rustix
• https://rustsec.org/advisories/RUSTSEC-2026-0486.html
• https://github.com/bytecodealliance/rustix/commit/8e6aaa6713d2bb64b1fdd8c472e3a32a10a76d70

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

bytecodealliance/rustix (rustix)

v1.1.6

Compare Source

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.