CVE-2021-31919 json
Use of uninitialized buffer in rkyv
published 2021-04-28 5 y ago modified 2026-06-17 4 mo ago also GHSA-w5cr-frph-hw7f , RUSTSEC-2021-0054 , EUVD-2021-1908
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 65%
- public exploits
- 0
- none known
Summary
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
Patch / fix
- crates.io rkyv 0.6.0
- rkyv_project rkyv 0.6.0
Exploit prediction
1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | rkyv | <0.6.0 >=0.0.0-0, <0.6.0 |
0.6.0 |
Classification
References
-
github.com
/djkoloski/rkyv/commit/9c65ae9c2c67dd949b5c3aba9b8eba6da802ab7e
web
-
github.com
/djkoloski/rkyv/commit/f141b560523a20557db6540576d153010bd18712
web
-
rustsec.org
/advisories/RUSTSEC-2021-0054.html
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-31919
advisory
-
github.com
/djkoloski/rkyv/issues/113
web, report
-
crates.io
/crates/rkyv
package
Sources
- CVE List CVE-2021-31919
- GitHub Advisory GHSA-w5cr-frph-hw7f
- NVD CVE-2021-31919
- OSV RUSTSEC-2021-0054
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.