Critical UNKNOWN READ Vulnerability in hobbes Package
Summary
OSV-2026-1408: UNKNOWN READ in hobbes::castexp::apply. Affects hobbes across 2 version ranges.
< 9075bea5a20e069eece29c82d7df1e80ac1429f6
>= b04da9e612f6d0bdd9d691c0396ae481dbfc6da9, < bff061afc31cfc460f38dd9c5c4b754b72b88de5
Fixed in bff061afc31cfc460f38dd9c5c4b754b72b88de5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The hobbes package is a library designed for advanced expression compilation and evaluation, primarily used in various software development projects. It provides functionalities for compiling and executing expressions efficiently. However, it has been identified to have a vulnerability that can lead to unexpected behavior, including crashes, due to improper handling of memory reads.
Vulnerability Detail
The vulnerability is categorized as an UNKNOWN READ, which occurs in the function hobbes::castexp::apply. This issue arises from a failure to properly manage memory access, potentially leading to crashes or undefined behavior. The vulnerability was reported through OSS-Fuzz, highlighting its impact on the stability of applications utilizing the hobbes package. If exploited, this could result in application crashes, data corruption, or other adverse effects, making it crucial for developers to address this issue promptly.
How To Fix
Minimum fixed version
bff061afc31cfc460f38dd9c5c4b754b72b88de5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, developers can avoid using the affected functions in the hobbes package until the package is updated. This may involve refactoring code to bypass the use of hobbes::castexp::apply and related functions.
Conclusion
The hobbes package has a critical UNKNOWN READ vulnerability that can lead to application crashes. It is essential for developers to update to the patched versions to ensure the stability and security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for hobbes →
FAQ
The UNKNOWN READ vulnerability involves improper memory access, which can lead to application crashes or undefined behavior.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
Failure to address this vulnerability may result in application instability, crashes, and potential data loss.
Yes, the hobbes package has patched versions available. It is recommended to update to the latest fixed version.
You can update the hobbes package by cloning the repository and checking out the fixed version using Git commands.
References
Related vulnerabilities
Recent vulnerabilities recorded for hobbes.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
