RUSTSEC-2025-0163

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2025-0163

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2025-0163.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2025-0163

Aliases

Published

2025-05-04T12:00:00Z

Modified

2026-06-10T06:13:29Z

Severity

2.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Unsound issue in Trailer

Details

Our static analyzer find a potential unsound issue in the construction of Trailer, where it doesn't provide enough check to ensure the soundness.

trailer/src/lib.rs, Lines 18 to 25 in d474984:

 pub fn new(capacity: usize) -> Trailer<T> { 
     unsafe { 
         let trailer = Trailer::allocate(capacity); 
         let ptr = trailer.ptr as *mut T; 
         ptr.write(T::default()); 
         trailer 
     } 
 }

The constructor does not check the T is not a ZST in rust, and allocating with size 0 is considered as undefined behaviors in Rust. A poc code like below can work:

use trailer::Trailer;
#[derive(Default)]
struct Zst;

fn main() {
    let mut a = Trailer::<Zst>::new(0);
    drop(a);
}

The trailer crate is unmaintained and this security issue will not be fixed.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / trailer

Package

Name: trailer; View open source insights on deps.dev
Purl: pkg:cargo/trailer

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}