UBUNTU-CVE-2026-25541

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-25541
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25541.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-25541
Upstream
Published
2026-02-04T22:16:00Z
Modified
2026-03-02T12:11:17.161141Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity >= newcap + offset" uses an unchecked addition. When newcap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as sparecapacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

References

Affected packages

Ubuntu:20.04:LTS / rust-bytes

Package

Name
rust-bytes
Purl
pkg:deb/ubuntu/rust-bytes@0.4.12-1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.4.12-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "0.4.12-1",
            "binary_name": "librust-bytes+either-dev"
        },
        {
            "binary_version": "0.4.12-1",
            "binary_name": "librust-bytes+i128-dev"
        },
        {
            "binary_version": "0.4.12-1",
            "binary_name": "librust-bytes+serde-dev"
        },
        {
            "binary_version": "0.4.12-1",
            "binary_name": "librust-bytes-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25541.json"

Ubuntu:22.04:LTS / rust-bytes

Package

Name
rust-bytes
Purl
pkg:deb/ubuntu/rust-bytes@1.1.0-1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.4.12-1
1.*
1.1.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.1.0-1",
            "binary_name": "librust-bytes+serde-dev"
        },
        {
            "binary_version": "1.1.0-1",
            "binary_name": "librust-bytes-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25541.json"

Ubuntu:24.04:LTS / rust-bytes

Package

Name
rust-bytes
Purl
pkg:deb/ubuntu/rust-bytes@1.5.0-1?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.4.0-1
1.5.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.0-1",
            "binary_name": "librust-bytes+serde-dev"
        },
        {
            "binary_version": "1.5.0-1",
            "binary_name": "librust-bytes-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25541.json"

Ubuntu:25.10 / rust-bytes

Package

Name
rust-bytes
Purl
pkg:deb/ubuntu/rust-bytes@1.9.0-1?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.9.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.9.0-1",
            "binary_name": "librust-bytes-dev"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-25541.json"