CVE-2026-25541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25541", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-02T19:59:47.375Z", "datePublished": "2026-02-04T22:03:53.554Z", "dateUpdated": "2026-02-05T15:13:34.031Z"}, "containers": {"cna": {"title": "Bytes is vulnerable to integer overflow in BytesMut::reserve", "problemTypes": [{"descriptions": [{"cweId": "CWE-680", "lang": "en", "description": "CWE-680: Integer Overflow to Buffer Overflow", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r"}, {"name": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f", "tags": ["x_refsource_MISC"], "url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f"}, {"name": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1"}, {"name": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html", "tags": ["x_refsource_MISC"], "url": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html"}], "affected": [{"vendor": "tokio-rs", "product": "bytes", "versions": [{"version": ">= 1.2.1, < 1.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T22:03:53.554Z"}, "descriptions": [{"lang": "en", "value": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity >= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1."}], "source": {"advisory": "GHSA-434x-w66g-qw3r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T15:13:12.910010Z", "id": "CVE-2026-25541", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T15:13:34.031Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25541", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T15:13:12.910010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T15:13:21.073Z"}}], "cna": {"title": "Bytes is vulnerable to integer overflow in BytesMut::reserve", "source": {"advisory": "GHSA-434x-w66g-qw3r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "tokio-rs", "product": "bytes", "versions": [{"status": "affected", "version": ">= 1.2.1, < 1.11.1"}]}], "references": [{"url": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r", "name": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f", "name": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1", "name": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1", "tags": ["x_refsource_MISC"]}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html", "name": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity >= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-680", "description": "CWE-680: Integer Overflow to Buffer Overflow"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T22:03:53.554Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25541", "state": "PUBLISHED", "dateUpdated": "2026-02-05T15:13:34.031Z", "dateReserved": "2026-02-02T19:59:47.375Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T22:03:53.554Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bytes", "vendor": "tokio-rs", "versions": [{"status": "affected", "version": ">= 1.2.1, < 1.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tokio-rs:bytes:*:*:*:*:*:rust:*:*", "matchCriteriaId": "20BFEB88-98B3-498A-9FFC-0C950ED8CF0D", "versionEndExcluding": "1.11.1", "versionStartIncluding": "1.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity >= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1."}, {"lang": "es", "value": "Bytes es una librer\u00eda de utilidad para trabajar con bytes. Desde la versi\u00f3n 1.2.1 hasta antes de la 1.11.1, Bytes es vulnerable a desbordamiento de entero en BytesMut::reserve. En la ruta de recuperaci\u00f3n \u00fanica de BytesMut::reserve, si la condici\u00f3n 'v_capacity &gt;= new_cap + offset' utiliza una adici\u00f3n sin verificar. Cuando new_cap + offset desborda usize en compilaciones de lanzamiento, esta condici\u00f3n puede pasar incorrectamente, haciendo que self.cap se establezca en un valor que excede la capacidad asignada real. Las API posteriores, como spare_capacity_mut(), conf\u00edan entonces en este valor de cap corrupto y pueden crear segmentos fuera de l\u00edmites, lo que lleva a UB. Este comportamiento es observable en compilaciones de lanzamiento (el desbordamiento de entero se ajusta), mientras que las compilaciones de depuraci\u00f3n entran en p\u00e1nico debido a las comprobaciones de desbordamiento. Este problema ha sido parcheado en la versi\u00f3n 1.11.1."}], "id": "CVE-2026-25541", "lastModified": "2026-06-17T10:24:49.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25541", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T15:13:12.910010Z", "version": "2.0.3"}}]}, "published": "2026-02-04T22:16:00.383", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-680"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:43:12.996516+00:00", "value": {"mitigation_remediation": ["Upgrade tokio-rs/bytes to version 1.11.1 or later to obtain the integer\u2011overflow fix.", "Ensure your Cargo.toml dependencies lock to a non\u2011vulnerable version, then rebuild all affected binaries.", "If an immediate upgrade is not feasible, avoid using BytesMut::reserve or limit the capacity to a safe bound until the library is patched."], "summary": {"action": "Patch", "impact": "Integer overflow leading to memory corruption via out-of-bounds slices"}, "threat_synthesis": {"affected_systems": "The vulnerability affects tokio-rs/bytes library versions 1.2.1 through 1.11.0. All applications that compile against these versions are impacted; the fix was applied in release 1.11.1.", "description_and_impact": "Bytes, a Rust byte handling library, has an integer overflow flaw in its BytesMut::reserve function. The overflow occurs when the code adds the desired capacity and an offset together without bounds checking. In release builds this can wrap, allowing the condition that validates the new capacity to succeed incorrectly. As a result, the internal buffer length is set beyond the actual allocation. Subsequent operations that trust this corrupted value can create slices that read or write past the allocated memory, causing undefined behavior and potential memory corruption.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation today. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply input that triggers the reserve method with a large offset, which is typically only possible within an application that adopts the unsafe path. The flaw manifests only in release builds; debug builds trigger a panic, so realistic exploitation is harder. Based on the description, it is inferred that the attack vector involves providing crafted input to the reserve method, but the specific details are not explicitly documented."}}}}, "created": "2026-02-05T11:39:29.890822+00:00", "updated": "2026-04-18T13:45:45.680884+00:00", "vendors": ["tokio", "tokio$PRODUCT$bytes"]}