GHSA-w5cr-frph-hw7f CVE-2021-31919 RUSTSEC-2021-0054
Use of uninitialized buffer in rkyv
High
crates.io
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.08%
- Chance of exploitation in the next 30 days. Higher than 65.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-772 Missing Release of Resource after Effective Lifetime
- CWE-908 Use of Uninitialized Resource
- Fix
0.6.0- Upgrade rkyv to this version or later
Description
An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rkyv crates.io → 0.6.0
- cargo
cargo update -p rkyv --precise 0.6.0
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-772: Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
How to prevent it
- Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
- Implementation: It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including error conditions.
- Operation, Architecture and Design: Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available. However, these functions are not available on all operating systems. When the current levels get close to the maximum that is defined for the application (see CWE-770), then limit the allocation of further resources to privileged users; alternately, begin releasing resources for less-privileged users. While this mitigation may protect the system from attack, it will not necessarily stop attackers from adversely impacting other users. Ensure that the application performs the appropriate error checks and error handling in case resources become unavailable (CWE-703).
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it
- Implementation: Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Implementation: Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Implementation: Avoid race conditions (CWE-362) during initialization routines.
- Build and Compilation: Run or compile the product with settings that generate warnings about uninitialized variables or data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| RUSTSEC-2026-0235 Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc | Not rated yet | Also affects rkyv |
| RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables | Not rated yet | Also affects rkyv |
| RUSTSEC-2026-0233 Crafted archives can cause a use-after-free during deserialization | Not rated yet | Also affects rkyv |
| GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution | Medium | Also affects rkyv |
| RUSTSEC-2026-0001 Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM | Not rated yet | Also affects rkyv |
| PYSEC-2026-4007 vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders… | Medium | Same weakness, CWE-772 |
| GHSA-pmjh-fq2x-6v4x undici vulnerable to Denial of Service via orphaned RetryHandler response body | Medium | Same weakness, CWE-772 |
| GHSA-3p27-qvp9-27qf Wasmtime has a leak in WASIp1 `fd_renumber` implementation | Medium | Same weakness, CWE-772 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor