Skip to content
Fencer Vulns
high 7.5

CVE-2026-25541 json

Bytes is vulnerable to integer overflow in BytesMut::reserve

published 2026-02-03 9 mo ago modified 2026-10-12 27 d ago also GHSA-434x-w66g-qw3r , RUSTSEC-2026-0007 , EUVD-2026-5321

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Patch / fix

  • crates.io bytes 1.11.1
  • tokio-rs bytes 1.11.1
  • rust-bytes Debian 14 1.11.1-1

debian advisories DEBIAN-CVE-2026-25541

  • aws-efs-utils SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6 3.3.4-150600.17.12.1
  • agama SLES for SAP applications 16.0, SLES 16.0 17+699.92879916c-160000.13.1
  • rustup SLES for SAP applications 16.0, SLES 16.0 1.29.1~0-160000.1.1
  • sccache SLES for SAP applications 16.0, SLES 16.0 0.18.0~2-160000.1.1
  • aws-nitro-enclaves-cli SLES 16.0, SLES for SAP applications 16.0 1.5.0~git0.2950b36-160000.1.1
  • aws-nitro-enclaves-cli SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6 1.5.0~git0.2950b36-150600.10.15.1
  • gstreamer-devtools SLES for SAP applications 16.0, SLES 16.0 1.26.7-160000.2.1
  • sccache SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 0.17.0~1-150600.10.14.1

suse advisories SUSE-SU-2026:5101-1SUSE-SU-2026:24236-1SUSE-SU-2026:24014-1SUSE-SU-2026:23983-1SUSE-SU-2026:23643-1SUSE-SU-2026:23659-1

  • zed openSUSE Tumbleweed 1.24.2-1.1
  • shadowsocks-libev openSUSE Leap 16.0 3.3.6-bp160.3.1
  • shadowsocks-rust openSUSE Leap 16.0 1.25.0-bp160.1.1
  • switcheroo openSUSE Tumbleweed 2.6.0-1.1
  • agama openSUSE Leap 16.0 17+699.92879916c-160000.13.1
  • rustup openSUSE Leap 16.0 1.29.1~0-160000.1.1
  • sccache openSUSE Leap 16.0 0.18.0~2-160000.1.1
  • tealdeer openSUSE Tumbleweed 1.8.0-2.1

opensuse advisories openSUSE-SU-2026:12355-1openSUSE-SU-2026:22189-1openSUSE-SU-2026:12205-1openSUSE-SU-2026:22075-1openSUSE-SU-2026:22016-1openSUSE-SU-2026:21982-1

  • kata-containers Azure Linux 3.0 3.19.1.kata2-6
  • netavark Azure Linux 3.0 1.10.3-7
  • azl-compliance CBL-Mariner 2.0 1.0.2-3
  • rpm-ostree Azure Linux 3.0 2024.4-8
  • rust Azure Linux 3.0 1.75.0-27
  • rust Azure Linux 3.0 1.90.0-6
  • trident Azure Linux 3.0 0.22.0-1
  • rust-afterburn Azure Linux 3.0 5.8.2-2

azure linux advisories AZL-76691AZL-76703AZL-76712AZL-76715AZL-76718AZL-76721

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r referenced PoC, tagged "exploit" by a source, unverified
  • rustsec.org https://rustsec.org/advisories/RUSTSEC-2026-0007.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 5.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
CNA 4.0 5.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
crates.io bytes
>=1.2.1, <1.11.1
1.11.1

Affected products

  • tokio-rs bytes

Classification

Weakness
  • CWE-680 Integer Overflow to Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.