CVE-2026-25541
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Feb 4, 2026
CISA due date
—
The record
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | bytes | 1.2.1 | 1.11.1 |
| Chainguard | asciinema | 0 | 3.1.0-r1 |
| Chainguard | atuin | 0 | 18.11.0-r1 |
| Chainguard | berg | 0 | 0.5.4-r2 |
| Chainguard | bootc-binary | 0 | 1.10.0-r2 |
| Chainguard | buck2 | 0 | 20260201-r1 |
| Chainguard | cargo-audit | 0 | 0.22.0-r1 |
| Chainguard | cargo-c | 0 | 0.10.20-r2 |
| Chainguard | deno | 0 | 2.6.8-r1 |
| Chainguard | efs-utils-for-aws-csi-driver | 0 | 2.4.1-r4 |
| Chainguard | fnm | 0 | 1.38.1-r8 |
| Chainguard | garage-1 | 0 | 1.3.1-r2 |
| Chainguard | garage-2 | 0 | 2.2.0-r1 |
| Chainguard | geckodriver | 0 | 0.36.0-r4 |
| Chainguard | guestproxyagent | 0 | 1.0.39-r1 |
| Chainguard | helix | 0 | 25.07.1-r2 |
| Chainguard | jujutsu | 0 | 0.38.0-r0 |
| Chainguard | kdash | 0 | 0.6.2-r10 |
| Chainguard | komodo-cli | 0 | 1.19.5-r2 |
| Chainguard | komodo-core | 0 | 1.19.5-r2 |
| Chainguard | komodo-periphery | 0 | 1.19.5-r2 |
| Chainguard | libwasmtime | 0 | 41.0.2-r1 |
| Chainguard | linkerd-await | 0 | 0.3.1-r1 |
| Chainguard | linkerd-extension-init | 0 | 0.1.7-r3 |
| Chainguard | linkerd-network-validator | 0 | 0.1.5-r1 |
| Chainguard | linkerd2-cni-repair-controller | 0 | 1.6.5-r2 |
| Chainguard | linkerd2-controller | 0 | 26.1.4-r1 |
| Chainguard | linkerd2-proxy | 0 | 2.338.0-r2 |
| Chainguard | lychee | 0 | 0.22.0-r3 |
| Chainguard | mdbook | 0 | 0.5.2-r2 |
| Chainguard | mountpoint-s3 | 0 | 1.22.0-r2 |
| Chainguard | netavark | 0 | 1.17.1-r2 |
| Chainguard | ntpd-rs | 0 | 1.7.0-r1 |
| Chainguard | nushell | 0 | 0.110.0-r1 |
| Chainguard | nushell-plugins | 0 | 0.110.0-r1 |
| Chainguard | oranda | 0 | 0.6.5-r13 |
| Chainguard | parseable | 0 | 2.5.10-r2 |
| Chainguard | pgcat | 0 | 1.2.0-r10 |
| Chainguard | pixi | 0 | 0.63.2-r2 |
| Chainguard | py3.10-hf-xet | 0 | 1.2.0-r4 |
| Chainguard | py3.10-uv-build-bin | 0 | 0.9.29-r1 |
| Chainguard | py3.11-hf-xet | 0 | 1.2.0-r4 |
| Chainguard | py3.11-uv-build-bin | 0 | 0.9.29-r1 |
| Chainguard | py3.12-hf-xet | 0 | 1.2.0-r4 |
| Chainguard | py3.13-hf-xet | 0 | 1.2.0-r4 |
| Chainguard | py3.13-uv-build-bin | 0 | 0.9.29-r1 |
| Chainguard | qdrant | 0 | 1.16.3-r3 |
| Chainguard | rustup | 0 | 1.28.2-r4 |
| Chainguard | samply | 0 | 0.13.1-r7 |
| Chainguard | sccache | 0 | 0.13.0-r2 |
| Chainguard | sdp-k8s-injector | 0 | 1.3.10-r2 |
| Chainguard | sentry-cli | 0 | 3.1.0-r1 |
| Chainguard | shadowsocks-rust-sslocal | 0 | 1.24.0-r2 |
| Chainguard | shadowsocks-rust-ssserver | 0 | 1.24.0-r2 |
| Chainguard | shadowsocks-rust-ssurl | 0 | 1.24.0-r2 |
| Chainguard | sqlx | 0 | 0.8.6-r3 |
| Chainguard | tealdeer | 0 | 1.8.1-r2 |
| Chainguard | topgrade | 0 | 16.9.0-r1 |
| Chainguard | uv | 0 | 0.9.29-r1 |
| Chainguard | valkey-ldap | 0 | 1.0.0-r1 |
| Chainguard | wadm | 0 | 0.21.1-r2 |
| Chainguard | wash | 0 | 0.39.0-r6 |
| Chainguard | wasmcloud | 0 | 1.9.2-r1 |
| Chainguard | watchexec | 0 | 2.3.3-r2 |
| Chainguard | wizer | 0 | 10.0.0-r6 |
| Chainguard | xh | 0 | 0.25.3-r1 |
| Chainguard | yazi | 0 | 26.1.22-r2 |
| Chainguard | zed | 0 | 0.223.3-r0 |
| Chainguard | zellij | 0 | 0.43.1-r5 |
| Chainguard | zizmor | 0 | 1.22.0-r2 |
| Chainguard | zola | 0 | 0.22.1-r1 |
| Chainguard | ztunnel-1.27 | 0 | 1.27.5-r3 |
| Chainguard | ztunnel-1.28 | 0 | 1.28.3-r2 |
| Chainguard | ztunnel-fips-1.27 | 0 | 1.27.5-r3 |
| Chainguard | ztunnel-fips-1.28 | 0 | 1.28.3-r1 |
| Wolfi | atuin | 0 | 18.11.0-r1 |
| Wolfi | berg | 0 | 0.5.4-r2 |
| Wolfi | buck2 | 0 | 20260201-r1 |
| Wolfi | cargo-audit | 0 | 0.22.0-r1 |
| Wolfi | cargo-c | 0 | 0.10.20-r2 |
| Wolfi | deno | 0 | 2.6.8-r1 |
| Wolfi | efs-utils-for-aws-csi-driver | 0 | 2.4.1-r4 |
| Wolfi | geckodriver | 0 | 0.36.0-r4 |
| Wolfi | helix | 0 | 25.07.1-r2 |
| Wolfi | kdash | 0 | 0.6.2-r10 |
| Wolfi | libwasmtime | 0 | 41.0.2-r1 |
| Wolfi | linkerd-await | 0 | 0.3.1-r1 |
| Wolfi | linkerd-extension-init | 0 | 0.1.7-r3 |
| Wolfi | linkerd-network-validator | 0 | 0.1.5-r1 |
| Wolfi | linkerd2-controller | 0 | 26.1.4-r1 |
| Wolfi | linkerd2-proxy | 0 | 2.338.0-r2 |
| Wolfi | lychee | 0 | 0.22.0-r3 |
| Wolfi | mdbook | 0 | 0.5.2-r2 |
| Wolfi | mountpoint-s3 | 0 | 1.22.0-r2 |
| Wolfi | netavark | 0 | 1.17.1-r2 |
| Wolfi | ntpd-rs | 0 | 1.7.0-r1 |
| Wolfi | nushell | 0 | 0.110.0-r1 |
| Wolfi | nushell-plugins | 0 | 0.110.0-r1 |
| Wolfi | oranda | 0 | 0.6.5-r13 |
| Wolfi | parseable | 0 | 2.5.10-r2 |
| Wolfi | pgcat | 0 | 1.2.0-r10 |
| Wolfi | pixi | 0 | 0.63.2-r2 |
| Wolfi | py3.10-hf-xet | 0 | 1.2.0-r4 |
| Wolfi | py3.10-uv-build-bin | 0 | 0.9.29-r1 |
| Wolfi | py3.11-hf-xet | 0 | 1.2.0-r4 |
| Wolfi | py3.11-uv-build-bin | 0 | 0.9.29-r1 |
| Wolfi | py3.12-hf-xet | 0 | 1.2.0-r4 |
| Wolfi | py3.13-hf-xet | 0 | 1.2.0-r4 |
| Wolfi | py3.13-uv-build-bin | 0 | 0.9.29-r1 |
| Wolfi | qdrant | 0 | 1.16.3-r3 |
| Wolfi | rustup | 0 | 1.28.2-r4 |
| Wolfi | samply | 0 | 0.13.1-r7 |
| Wolfi | sccache | 0 | 0.13.0-r2 |
| Wolfi | sdp-k8s-injector | 0 | 1.3.10-r2 |
| Wolfi | shadowsocks-rust-sslocal | 0 | 1.24.0-r2 |
| Wolfi | shadowsocks-rust-ssserver | 0 | 1.24.0-r2 |
| Wolfi | shadowsocks-rust-ssurl | 0 | 1.24.0-r2 |
| Wolfi | sqlx | 0 | 0.8.6-r3 |
| Wolfi | tealdeer | 0 | 1.8.1-r2 |
| Wolfi | topgrade | 0 | 16.9.0-r1 |
| Wolfi | uv | 0 | 0.9.29-r1 |
| Wolfi | wadm | 0 | 0.21.1-r2 |
| Wolfi | wash | 0 | 0.39.0-r6 |
| Wolfi | wasmcloud | 0 | 1.9.2-r1 |
| Wolfi | wizer | 0 | 10.0.0-r6 |
| Wolfi | xh | 0 | 0.25.3-r1 |
| Wolfi | yazi | 0 | 26.1.22-r2 |
| Wolfi | zed | 0 | 0.223.3-r0 |
| Wolfi | zellij | 0 | 0.43.1-r5 |
| Wolfi | zizmor | 0 | 1.22.0-r2 |
| Wolfi | zola | 0 | 0.22.1-r1 |
| Wolfi | ztunnel-1.27 | 0 | 1.27.5-r3 |
| Wolfi | ztunnel-1.28 | 0 | 1.28.3-r2 |
Related vulnerabilities
- RUSTSEC-2026-0007 Integer overflow in `BytesMut::reserve` Same vulnerability
- CVE-2026-31812 Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Also affects asciinema
- CVE-2026-25727 time provides date and time handling in Rust. Also affects atuin
- CVE-2026-21895 The `rsa` crate is an RSA implementation written in rust. Also affects atuin
- GHSA-9c48-w39g-hm26 rsa crate has potential panic on a prime being equal to 1 Also affects atuin
- CVE-2024-12224 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded Also affects atuin
- CVE-2024-47609 Tonic is a native gRPC client & server implementation with async/await support. Also affects atuin
- CVE-2023-49092 RustCrypto/RSA is a portable RSA implementation in pure Rust. Also affects atuin