RUSTSEC-2026-0199: bcrypt crate DoS via Panic in verify on Non-ASCII Input

Vulnerability Overview Vulnerability ID: RUSTSEC-2026-0199 Title: Panic in on non-ASCII hash input Report Date: June 20, 2026 Publish Date: July 4, 2026 Affected Package: bcrypt (crates.io) Type: Denial-of-service CVSS Score: 5.3 (MEDIUM) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Versions Description: and panic at when given a 60-byte containing multi-byte UTF-8 characters. Impact: Any Rust code calling (or ) with an attacker-controlled hash string will panic. Since the crate uses , this is limited to denial of service and does not lead to memory corruption. Real-world Attack Scenarios: - Rust authentication services reading hashes from a previously compromised database. An attacker can crash the service on every login attempt. - CLI tools that accept hashes from stdin or command-line arguments. - Password managers or vault services loading hashes from untrusted configuration sources. Remediation Root Cause: performs five slice operations on the input hash without proper bounds checking. When multi-byte UTF-8 characters span these byte positions, it results in a panic. Remediation: now rejects hashes containing non-ASCII bytes at the start of the hash string. Since valid bcrypt hashes are always 60 ASCII bytes, this blocks the entire class of byte-boundary panics rather than protecting against them slice by slice. Fix Commit: The fix was merged in PR #103 and released as on 2026-06-20. Downstream Impact (which depends on ) is unaffected. Its Python-side wrapper performs its own byte-level salt parsing before calling , and never reaches the buggy code paths or . POC Code Additional Information Keywords: #panic #utf-8 #denial-of-service References: - GitHub Pull Request #103 - GitHub Issue #62 - GitHub Pull Request #95 - GitHub Commit License This advisory is provided under the CC0-1.0 license.

Goal Reached Thanks to every supporter — we hit 100%!

RUSTSEC-2026-0199: bcrypt crate DoS via Panic in verify on Non-ASCII Input