The xxhash-rust crate version <0.8.16 contains a vulnerability where the safe API function xxh3_64_with_secret accepts a custom secret slice shorter than the internal minimum length. The length check is enforced only by debug_assert!, which is disabled in release builds, causing undefined behavior such as dangling references when the function attempts to read a fixed-width secret from an insufficiently sized slice. This was demonstrated using release-Miri, which reported invalid reference construction. A local fix involves validating the secret length before such reads. This vulnerability is tracked as CWE-125 (Out-of-bounds Read).

The vulnerability can cause undefined behavior including memory safety violations due to out-of-bounds reads of the secret slice in release builds. The CVSS score is low (2.3) with low confidentiality impact and no integrity or availability impact. Exploitation requires local privileges (AV:L) and high privileges (PR:H). There are no known exploits in the wild.

A patch is available that fixes this issue in xxhash-rust version 0.8.16 and later. Users should upgrade to version 0.8.16 or newer to mitigate this vulnerability. Until patched, avoid passing custom secrets shorter than the required minimum length to the affected API.