Add advisory for bcrypt panic regression (CVE candidate)

[MuhammedHussein17]

Adds an advisory for the panic in bcrypt::verify on non-ASCII hash input,
fixed in bcrypt 0.19.2 (Keats/rust-bcrypt PR #103).

Affected crate(s)

• bcrypt — 13,644,923 all-time downloads on crates.io

Links to upstream issue(s) or PR(s)

• Upstream fix: Reject non-ASCII bytes in hash string to prevent panic (regression of #62) Keats/rust-bcrypt#103 (merged)
• Original bug (2021): Panic when verifying with malformed hash Keats/rust-bcrypt#62
• Regression-introducing PR (2026): Support allocation free usage of bcrypt Keats/rust-bcrypt#95
• Fix commit: Keats/rust-bcrypt@f5f1ee2
• Release: bcrypt 0.19.2 on crates.io (2026-06-20)

Prior to filing this advisory, the vulnerability was disclosed privately
to the maintainer (Vincent Prouillet / @Keats) via email. He acknowledged
the report, requested a PR, and merged the fix. He was notified in advance
of my intent to file this informational advisory with RustSec.

Severity

Denial of service via panic in str::slice_error_fail. Any Rust code
calling bcrypt::verify or HashParts::from_str with an attacker-
controlled hash string will crash. Limited to DoS because the crate is
#![forbid(unsafe_code)] — no memory corruption is possible.

CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L = 5.3 (Medium)

Affected versions: >= 0.19.0, < 0.19.2

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Thanks!