Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

bytes

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5crates.ioPublished

    bytes has integer overflow in BytesMut::reserve

    CVE-2026-25541 · GHSA-434x-w66g-qw3r

    Affected
    • crates.io bytes >= 1.2.1, < 1.11.1
    Fixed in
    1.11.1· Vendor fix available
    Issue
    Details In the unique reclaim path of BytesMut::reserve, the condition uses an unchecked addition. When newcap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as sparecapacitymut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. PoC Workarounds Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply. This vulnerability is also known as RUSTSEC-2026-0007.

    Recommended action: Upgrade to 1.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →