-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from a pattern where: 1) Vectors are created with capacity 2) Unsafe set_len() is used to expand without initialization 3) The uninitialized buffer is passed to read_exact(). This violates Rust's safety requirements as per Read trait documentation. Multiple independent sources (GitHub advisory, RustSec advisory, and issue #2) explicitly name these four functions and show code examples demonstrating the unsafe pattern. The file path is confirmed through code snippets in the GitHub issue discussion.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| messagepack-rs | rust | <= 0.8.1 |
RustRustOngoing coverage of React2Shell