Vulnerability-Lookup

OPENSUSE-SU-2026:21605-1

Vulnerability from csaf_opensuse - Published: 2026-08-18 16:51 - Updated: 2026-09-17 17:42

Summary

Security update for forgejo-cli

Severity

Important

Notes

Title of the patch: Security update for forgejo-cli

Description of the patch: This update for forgejo-cli fixes the following issues: Changes in forgejo-cli: - Update vendored bytes crate to 1.12.1 * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529). - update to 0.6.0: * Localization! - forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/ * Additions - (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request - (!582) --avatar/--unset-avatar options on fj repo edit - (!554) fj repo star-status to check if you've starred a repo - (!547) --cwd option to set the working directory a command is run in - (!533, !561) Commands to watch and unwatch repos - (!462) Resolve SSH host names from SSH config - (!279, !464, !472, !489, !491, !513, !594) Localization - Added fj auth login support for the following instances: - v16.next.forgejo.org - v17.next.forgejo.org - Removed fj auth login support for the following instances that have shut down: - v7.next.forgejo.org - v12.next.forgejo.org * Changes - (!535) Added an error message when fj auth login fails to open the browser - (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change. - (!514) The --host flag can now be anywhere in the command, instead of only the beginning - (!504) fj auth add-token no longer takes a username argument. * Fixes - (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users - (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash - (!542) Fixed parsing of SSH shorthand urls - (!510) Fixed fj pr checkout failing when the instance URL contained a port - (!437) Fixed incorrect parsing of activity info * Other - (!573) Use rust 2024 edition - (!560) Simplify determining repo owner - (!531) Fix clippy warnings - (!527) Remove unused dependencies, narrow tokio features - (!526) Replace crossterm with terminal_size - (!520) Optimize cargo release profile - (!469) Fix typo - (!449) Restricted file permissions at creation time - (!443) Add oneline helptext to 'repo migrate' command - update to 0.5.0: * Additions - (!334) Support for managing labels on issues and repos. - (!349) repo edit and repo units for modifying settings on a repo and repo units. - (!373) Use the needed CLI flags for more editors when opening them. - (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set). - (!414) Add commands to assign and unassign users to issues and PRs. - (!415) Support all README files in fj repo readme, regardless of case or extension. - (!416) Add the option to choose what repo to own the new repo to fj repo migrate. - (!419) Show a warning when viewing an archived repo. - (!420) Add a notice about git push --force not being supported on AGit PRs. - Added fj auth login support for the following instances: - v15.next.forgejo.org - codefloe.com * Fixes - (!393) Don't include pull requests in fj issues search. - (!407) Guarantee opening the browser in fj auth login doesn't block. - (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens. * Other - (!278) Improved "no repo info" error message. - (!403) Build aarch64 artifacts for new releases. - update to 0.4.1: * Fixes - (!368) Generate the correct PKCE challenge verifier. This was preventing fj auth login from succeeding. - Update to version 0.4.0: * Support for issue & pull request templates with fj issue/pr create --template * fj pr create --autofill, which will automatically populate the PR's title and body from the commit(s) * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys * fj user repos --page, to select the page of results to view * fj issue/pr create/comment --body-from-file to use the contents of a file as the body * --identity-file/-I flag for selecting the SSH identity to use * fj tag to manage git tags * fj issue search --state all * --remote & --repo flags can now be at the end of the command with the rest of the flags - update to 0.3.0: * Additions - Added fj completion to generate completion scripts for various shells - Added fj org for Organization commands. - Added fj actions for Forgejo Actions-related commands (thank you, @LordMZTE !) - OAuth client IDs for fj auth login can now be customized. See the wiki for more on the new features. https://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations * Fixes - Keys file now has proper file permissions - Fixed incorrect help commands (thank you, @0ko !) - Always set user agent in requests - update to 0.2.0: * Additions - pr create and issue create now have a --web flag that opens the creation page in your browser instead of creating it on the terminal. - pr --agit will create a pull request with agit flow, so you don't need to fork the repository. - pr status --wait will only exits once all PR checks finish. - repo migrate to migrate/mirror repositories from other hosts. - repo readme to print a repository's readme to the terminal. - version --verbose prints extra info useful for debugging * Fixes - Public endpoints can now be accessed without authenticating - The API will be accessed via the http url even when it differs from the ssh url and the local remote points to the ssh url. - browse commands will no long hang the terminal - Local repos will now be found even when in a subdirectory - SSH urls in repo remotes will now be parsed correctly - Improved pull request detection

Patchnames: openSUSE-Leap-16.0-packagehub-506

CVE-2025-3416

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64	—	Vendor Fix

Threats

Impact low

CVE-2025-55159

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

Affected products

Recommended 4 products, the same list as for CVE-2025-3416

Threats

Impact moderate

CVE-2026-25541

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2025-3416

Threats

Impact important

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1242683	self
https://bugzilla.suse.com/1248047	self
https://bugzilla.suse.com/1274529	self
https://www.suse.com/security/cve/CVE-2025-3416/	self
https://www.suse.com/security/cve/CVE-2025-55159/	self
https://www.suse.com/security/cve/CVE-2026-25541/	self
https://www.suse.com/security/cve/CVE-2025-3416	external
https://bugzilla.suse.com/1242599	external
https://www.suse.com/security/cve/CVE-2025-55159	external
https://bugzilla.suse.com/1248000	external
https://www.suse.com/security/cve/CVE-2026-25541	external
https://bugzilla.suse.com/1271347	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for forgejo-cli",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for forgejo-cli fixes the following issues:\n\nChanges in forgejo-cli:\n\n- Update vendored bytes crate to 1.12.1\n  * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could\n    corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).\n\n- update to 0.6.0:\n  * Localization!\n    - forgejo-cli has gained localization support!\n      You can now use it in your preferred language, just like\n      Forgejo itself.\n      Currently de-DE and zh-Hans are included, with several more\n      being in-progress.\n      See the project on Codeberg Translate if you want to help out\n      with any languages you know!\n      https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/\n  * Additions\n    - (!586) fj issue/pr view assignees to see who is assigned to\n      an issue or pull request\n    - (!582) --avatar/--unset-avatar options on fj repo edit\n    - (!554) fj repo star-status to check if you\u0027ve starred a repo\n    - (!547) --cwd option to set the working directory a command is\n      run in\n    - (!533, !561) Commands to watch and unwatch repos\n    - (!462) Resolve SSH host names from SSH config\n    - (!279, !464, !472, !489, !491, !513, !594) Localization\n    - Added fj auth login support for the following instances:\n      - v16.next.forgejo.org\n      - v17.next.forgejo.org\n    - Removed fj auth login support for the following instances\n      that have shut down:\n      - v7.next.forgejo.org\n      - v12.next.forgejo.org\n  * Changes\n    - (!535) Added an error message when fj auth login fails to\n      open the browser\n    - (!523) fj auth add-key was renamed to fj auth add-token. An\n      alias still exists to add-key, so this isn\u0027t a breaking\n      change.\n    - (!514) The --host flag can now be anywhere in the command,\n      instead of only the beginning\n    - (!504) fj auth add-token no longer takes a username argument.\n  * Fixes\n    - (!579) Fixed fj issue unassign incorrectly unassigning\n      everyone except the intended users\n    - (!569) Fixed display of labels failing when a label is marked\n      as exclusive but does not contain a slash\n    - (!542) Fixed parsing of SSH shorthand urls\n    - (!510) Fixed fj pr checkout failing when the instance URL\n      contained a port\n    - (!437) Fixed incorrect parsing of activity info\n  * Other\n    - (!573) Use rust 2024 edition\n    - (!560) Simplify determining repo owner\n    - (!531) Fix clippy warnings\n    - (!527) Remove unused dependencies, narrow tokio features\n    - (!526) Replace crossterm with terminal_size\n    - (!520) Optimize cargo release profile\n    - (!469) Fix typo\n    - (!449) Restricted file permissions at creation time\n    - (!443) Add oneline helptext to \u0027repo migrate\u0027 command\n\n- update to 0.5.0:\n  * Additions\n    - (!334) Support for managing labels on issues and repos.\n    - (!349) repo edit and repo units for modifying settings on a\n      repo and repo units.\n    - (!373) Use the needed CLI flags for more editors when opening\n      them.\n    - (!385) Use the editor defined in git\u0027s core.editor config\n      option by default (falling back to $EDITOR if it is not set).\n    - (!414) Add commands to assign and unassign users to issues\n      and PRs.\n    - (!415) Support all README files in fj repo readme, regardless\n      of case or extension.\n    - (!416) Add the option to choose what repo to own the new repo\n      to fj repo migrate.\n    - (!419) Show a warning when viewing an archived repo.\n    - (!420) Add a notice about git push --force not being\n      supported on AGit PRs.\n    - Added fj auth login support for the following instances:\n      - v15.next.forgejo.org\n      - codefloe.com\n  * Fixes\n    - (!393) Don\u0027t include pull requests in fj issues search.\n    - (!407) Guarantee opening the browser in fj auth login doesn\u0027t\n      block.\n    - (!417) Prevent incorrectly reusing the refresh token when\n      refreshing OAuth tokens.\n  * Other\n    - (!278) Improved \"no repo info\" error message.\n    - (!403) Build aarch64 artifacts for new releases.\n\n- update to 0.4.1:\n  * Fixes\n    - (!368) Generate the correct PKCE challenge verifier. This was\n      preventing fj auth login from succeeding.\n\n- Update to version 0.4.0:\n  * Support for issue \u0026 pull request templates with fj issue/pr create\n    --template\n  * fj pr create --autofill, which will automatically populate the PR\u0027s title\n    and body from the commit(s)\n  * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys\n  * fj user repos --page, to select the page of results to view\n  * fj issue/pr create/comment --body-from-file to use the contents of a file\n    as the body\n  * --identity-file/-I flag for selecting the SSH identity to use\n  * fj tag to manage git tags\n  * fj issue search --state all\n  * --remote \u0026 --repo flags can now be at the end of the command with the rest\n    of the flags\n\n- update to 0.3.0:\n  * Additions\n    - Added fj completion to generate completion scripts for various\n      shells\n    - Added fj org for Organization commands.\n    - Added fj actions for Forgejo Actions-related commands (thank\n      you, @LordMZTE !)\n    - OAuth client IDs for fj auth login can now be customized.\n    See the wiki for more on the new features.\n\thttps://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations\n  * Fixes\n    - Keys file now has proper file permissions\n    - Fixed incorrect help commands (thank you, @0ko !)\n    - Always set user agent in requests\n\n- update to 0.2.0:\n  * Additions\n    - pr create and issue create now have a --web flag that opens\n      the creation page in your browser instead of creating it on\n      the terminal.\n    - pr --agit will create a pull request with agit flow, so you\n      don\u0027t need to fork the repository.\n    - pr status --wait will only exits once all PR checks finish.\n    - repo migrate to migrate/mirror repositories from other hosts.\n    - repo readme to print a repository\u0027s readme to the terminal.\n    - version --verbose prints extra info useful for debugging\n  * Fixes\n    - Public endpoints can now be accessed without authenticating\n    - The API will be accessed via the http url even when it\n      differs from the ssh url and the local remote points to the\n      ssh url.\n    - browse commands will no long hang the terminal\n    - Local repos will now be found even when in a subdirectory\n    - SSH urls in repo remotes will now be parsed correctly\n    - Improved pull request detection\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-506",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21605-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1242683",
        "url": "https://bugzilla.suse.com/1242683"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248047",
        "url": "https://bugzilla.suse.com/1248047"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1274529",
        "url": "https://bugzilla.suse.com/1274529"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-3416 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-3416/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-55159 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-55159/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-25541 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-25541/"
      }
    ],
    "title": "Security update for forgejo-cli",
    "tracking": {
      "current_release_date": "2026-09-17T17:42:02Z",
      "generator": {
        "date": "2026-08-18T16:51:08Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21605-1",
      "initial_release_date": "2026-08-18T16:51:08Z",
      "revision_history": [
        {
          "date": "2026-08-18T16:51:08Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:45:28Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:46:40Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:42:02Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
                "product": {
                  "name": "forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
                  "product_id": "forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/forgejo-cli@0.6.0-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
                "product": {
                  "name": "forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
                  "product_id": "forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/forgejo-cli@0.6.0-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "forgejo-cli-0:0.6.0-bp160.1.1.s390x",
                "product": {
                  "name": "forgejo-cli-0:0.6.0-bp160.1.1.s390x",
                  "product_id": "forgejo-cli-0:0.6.0-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/forgejo-cli@0.6.0-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "forgejo-cli-0:0.6.0-bp160.1.1.x86_64",
                "product": {
                  "name": "forgejo-cli-0:0.6.0-bp160.1.1.x86_64",
                  "product_id": "forgejo-cli-0:0.6.0-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/forgejo-cli@0.6.0-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "forgejo-cli-0:0.6.0-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64"
        },
        "product_reference": "forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "forgejo-cli-0:0.6.0-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le"
        },
        "product_reference": "forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "forgejo-cli-0:0.6.0-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x"
        },
        "product_reference": "forgejo-cli-0:0.6.0-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "forgejo-cli-0:0.6.0-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
        },
        "product_reference": "forgejo-cli-0:0.6.0-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-3416",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-3416"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenSSL\u0027s handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-3416",
          "url": "https://www.suse.com/security/cve/CVE-2025-3416"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1242599 for CVE-2025-3416",
          "url": "https://bugzilla.suse.com/1242599"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-18T16:51:08Z",
          "details": "low"
        }
      ],
      "title": "CVE-2025-3416"
    },
    {
      "cve": "CVE-2025-55159",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-55159"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0027s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0027s actual length.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-55159",
          "url": "https://www.suse.com/security/cve/CVE-2025-55159"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248000 for CVE-2025-55159",
          "url": "https://bugzilla.suse.com/1248000"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-18T16:51:08Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-55159"
    },
    {
      "cve": "CVE-2026-25541",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-25541"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
          "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-25541",
          "url": "https://www.suse.com/security/cve/CVE-2026-25541"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271347 for CVE-2026-25541",
          "url": "https://bugzilla.suse.com/1271347"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.s390x",
            "openSUSE Leap 16.0:forgejo-cli-0:0.6.0-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-18T16:51:08Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-25541"
    }
  ]
}

CVE-2025-3416 (GCVE-0-2025-3416)

Vulnerability from cvelistv5 – Published: 2025-04-08 18:24 – Updated: 2026-06-30 07:03

Title

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

Summary

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-08 19:02 UTC

CWE

CWE-416 - Use After Free

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2025-3416	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2357560	issue-trackingx_refsource_REDHAT
https://github.com/sfackler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/8…
https://github.com/sfackler/rust-openssl/pull/2390
https://rustsec.org/advisories/RUSTSEC-2025-0022.html

Impacted products

11 products

Vendor	Product	Version
		Affected: 0.10.39 , < 0.10.72 (semver)
Red Hat	Red Hat Directory Server 11	cpe:/a:redhat:directory_server:11
Red Hat	Red Hat Directory Server 12	cpe:/a:redhat:directory_server:12
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Red Hat Trusted Profile Analyzer	cpe:/a:redhat:trusted_profile_analyzer:1

Date Public

2025-04-04 20:31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3416",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T19:02:06.643346Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T19:02:13.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/sfackler/rust-openssl",
          "defaultStatus": "unaffected",
          "packageName": "rust-openssl",
          "versions": [
            {
              "lessThan": "0.10.72",
              "status": "affected",
              "version": "0.10.39",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:11"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:11/389-ds-base",
          "product": "Red Hat Directory Server 11",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:directory_server:12"
          ],
          "defaultStatus": "affected",
          "packageName": "redhat-ds:12/389-ds-base",
          "product": "Red Hat Directory Server 12",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "firefox",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "gjs",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm-ostree",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "openssl",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "firefox",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds:1.4/389-ds-base",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "firefox",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "mingw-openssl",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "mozjs60",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "python3.12-cryptography",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm-ostree",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "389-ds-base",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "firefox",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "firefox:flatpak/firefox",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gjs",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "keylime-agent-rust",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "polkit",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "python3.12-cryptography",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm-ostree",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "rust-bootupd",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "kata-containers",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rpm-ostree",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/tuffer-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/tuftool-rhel9",
          "product": "Red Hat Trusted Artifact Signer",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:trusted_profile_analyzer:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtpa/rhtpa-trustification-service-rhel9",
          "product": "Red Hat Trusted Profile Analyzer",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-04-04T20:31:08.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenSSL\u0027s handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T07:03:15.074Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-3416"
        },
        {
          "name": "RHBZ#2357560",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357560"
        },
        {
          "url": "https://github.com/sfackler/rust-openssl"
        },
        {
          "url": "https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081f607a334beae4"
        },
        {
          "url": "https://github.com/sfackler/rust-openssl/pull/2390"
        },
        {
          "url": "https://rustsec.org/advisories/RUSTSEC-2025-0022.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-04T21:02:15.898Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-04-04T20:31:08.000Z",
          "value": "Made public."
        }
      ],
      "title": "Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-3416",
    "datePublished": "2025-04-08T18:24:22.102Z",
    "dateReserved": "2025-04-07T14:33:50.264Z",
    "dateUpdated": "2026-06-30T07:03:15.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-55159 (GCVE-0-2025-55159)

Vulnerability from cvelistv5 – Published: 2025-08-11 23:00 – Updated: 2025-08-12 14:07

Title

slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

Summary

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-12 14:06 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/tokio-rs/slab/security/advisor…	x_refsource_CONFIRM
https://github.com/tokio-rs/slab/pull/152	x_refsource_MISC
https://github.com/tokio-rs/slab/commit/2d65c514b…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tokio-rs	slab	Affected: >= 0.4.10, < 0.4.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55159",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-12T14:06:53.117320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-12T14:07:00.276Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "slab",
          "vendor": "tokio-rs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.10, \u003c 0.4.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0027s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0027s actual length."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-11T23:00:58.915Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv"
        },
        {
          "name": "https://github.com/tokio-rs/slab/pull/152",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tokio-rs/slab/pull/152"
        },
        {
          "name": "https://github.com/tokio-rs/slab/commit/2d65c514bc964b192bab212ddf3c1fcea4ae96b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tokio-rs/slab/commit/2d65c514bc964b192bab212ddf3c1fcea4ae96b8"
        }
      ],
      "source": {
        "advisory": "GHSA-qx2v-8332-m4fv",
        "discovery": "UNKNOWN"
      },
      "title": "slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55159",
    "datePublished": "2025-08-11T23:00:58.915Z",
    "dateReserved": "2025-08-07T18:27:23.306Z",
    "dateUpdated": "2025-08-12T14:07:00.276Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-25541 (GCVE-0-2026-25541)

Vulnerability from cvelistv5 – Published: 2026-02-04 22:03 – Updated: 2026-02-05 15:13

Title

Bytes is vulnerable to integer overflow in BytesMut::reserve

Summary

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

Severity

5.5 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-05 15:13 UTC

CWE

CWE-680 - Integer Overflow to Buffer Overflow

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/tokio-rs/bytes/security/adviso…	x_refsource_CONFIRM
https://github.com/tokio-rs/bytes/commit/d0293b0e…	x_refsource_MISC
https://github.com/tokio-rs/bytes/releases/tag/v1.11.1	x_refsource_MISC
https://rustsec.org/advisories/RUSTSEC-2026-0007.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
tokio-rs	bytes	Affected: >= 1.2.1, < 1.11.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25541",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T15:13:12.910010Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T15:13:34.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bytes",
          "vendor": "tokio-rs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.2.1, \u003c 1.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition \"v_capacity \u003e= new_cap + offset\" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-680",
              "description": "CWE-680: Integer Overflow to Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-04T22:03:53.554Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r"
        },
        {
          "name": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f"
        },
        {
          "name": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/tokio-rs/bytes/releases/tag/v1.11.1"
        },
        {
          "name": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://rustsec.org/advisories/RUSTSEC-2026-0007.html"
        }
      ],
      "source": {
        "advisory": "GHSA-434x-w66g-qw3r",
        "discovery": "UNKNOWN"
      },
      "title": "Bytes is vulnerable to integer overflow in BytesMut::reserve"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25541",
    "datePublished": "2026-02-04T22:03:53.554Z",
    "dateReserved": "2026-02-02T19:59:47.375Z",
    "dateUpdated": "2026-02-05T15:13:34.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:21605-1

CVE-2025-3416 (GCVE-0-2025-3416)

CVE-2025-55159 (GCVE-0-2025-55159)

CVE-2026-25541 (GCVE-0-2026-25541)

Tags

Sightings

Nomenclature

Related by attack behaviour