Several functions in the cstruct library contain logical indexing and bounds-calculation errors (CWE-682) that cause incorrect data handling. Specifically, Cstruct.filter_map writes retained bytes at original input positions causing corrupted output when bytes are dropped; Cstruct.tail with rev:true removes two bytes instead of one and raises exceptions on single-byte views; Cstruct.cuts with rev:true may split input incorrectly and use offsets outside the requested view; Cstruct.find and Cstruct.find_sub with rev:true may return slices from wrong locations on non-zero-offset views. These bugs do not cause direct memory safety violations but can result in corrupted data, unexpected exceptions, incorrect splits, or disclosure of adjacent buffer contents. The issues were reported in September 2026 and fixed in cstruct version 6.3.0.

Affected functions may return corrupted data, raise unexpected exceptions, split input incorrectly, or return bytes outside the requested view but still within the backing buffer. In security-sensitive parsing contexts, this can lead to validation bypasses, denial of service, or unintended disclosure of adjacent buffer contents. There are no direct memory safety violations, but the logical errors undermine data integrity and reliability.

A patch fixing these issues is available in cstruct version 6.3.0. Users should upgrade to this version to remediate the vulnerabilities. For those unable to upgrade, backporting the source changes from the patch is recommended. There are no configuration-based mitigations since the issues stem from buggy library calls.