Cyber Resilience Act

[Walter Bright]

On 9/17/2026 2:35 AM, Gregor Mückl wrote:
> It's a bit more than that. Looking at  MITRE's CWE Top 25 as an arbitrary 
> reference [1], I a couple of vulnerability classes that can be produced in 
> carelessly written D code:
> 
> - Out-of-bounds Write
> - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
> - Use After Free
> - Out-of-bounds Read
> - Improper Neutralization of Special Elements used in an OS Command ('OS Command 
> Injection')
> - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
> - NULL Pointer Dereference
> - Stack-based Buffer Overflow
> - Heap-based Buffer Overflow
> - Improper Neutralization of Special Elements used in a Command ('Command 
> Injection')
> 
> Gregor
> 
> [1] https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html
> 

Most of those are not allowed in code tagged with @safe.