GHSA-jf5h-cf95-w759

Описание

When activating the non-default feature serialize, most structs implement serde::Deserialize without sufficient validation. This allows breaking invariants in safe code, leading to:

• Undefined behavior in as_string() methods (which use std::str::from_utf8_unchecked() internally).
• Panics due to failed assertions.

See https://github.com/gz/rust-cpuid/issues/43.