5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25541

CVE-2026-25541: Bytes is vulnerable to integer overflow in BytesMut::reserve

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25541

CVE-2026-25541:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bytes	rust	>= 1.2.1, < 1.11.1	1.11.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the bytes crate, specifically within the BytesMut::reserve function. The root cause is an integer overflow that occurs during a capacity check. When a large value is passed to reserve, the calculation new_cap + offset can wrap around in release builds, leading to an incorrect validation of the buffer's capacity. This allows the internal capacity field to be set to a value greater than the actual allocated memory. Subsequent operations that rely on this incorrect capacity, such as put_u8, can then write data out-of-bounds, leading to memory corruption and undefined behavior. The patch addresses this by replacing the unchecked addition with checked_add, which panics on overflow, thus preventing the vulnerability.

Vulnerable functions

BytesMut::reserve

src/bytes_mut.rs

The `reserve` function in `BytesMut` is vulnerable to an integer overflow. The expression `new_cap + offset` was not checked for overflow. In release builds where integer overflows wrap, a large value for `new_cap` could cause the sum to wrap around to a small value, making the capacity check `v_capacity >= new_cap + offset` pass incorrectly. This would lead to `self.cap` being set to a value larger than the actual allocated memory, causing subsequent writes to be out-of-bounds.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.