Uncaught Exception Affecting bcrypt package, versions >=0.19.0 <0.19.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-BCRYPT-17816618
- published4 Jul 2026
- disclosed20 Jun 2026
- creditUnknown
Introduced: 20 Jun 2026
CVE NOT AVAILABLE CWE-248 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade bcrypt to version 0.19.2 or higher.
Overview
Affected versions of this package are vulnerable to Uncaught Exception when the verify function or HashParts::from_str processes a 60-byte string containing a multi-byte UTF-8 character at certain byte positions. An attacker can cause the application to panic and terminate unexpectedly by supplying a specially crafted hash string containing non-ASCII bytes.