2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-q5h2-xq96-6gmc

GHSA-q5h2-xq96-6gmc: Duplicate Advisory: buffered-reader vulnerable to out-of-bounds array access leading to panic

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-29mf-62xx-28jq. This link is maintained to preserve external references.

Original Description

The buffered-reader crate before 1.2.0 for Rust allows out-of-bounds array access and a panic.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-q5h2-xq96-6gmc

GHSA-q5h2-xq96-6gmc:

2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
buffered-reader	rust	< 1.0.2	1.0.2
buffered-reader	rust	>= 1.1.0, < 1.1.5	1.1.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an out-of-bounds read in the buffered-reader crate, leading to a panic. The root cause is a logic error in the fill_buf function within buffered-reader/src/lib.rs. When a read operation on the underlying reader returned a partial result along with an error, the internal state of the BufferedReader was not updated correctly. Specifically, the filled field, which tracks the amount of valid data in the buffer, was not incremented with the number of bytes read before the error was returned. This inconsistency could cause subsequent operations to attempt to read beyond the valid data in the buffer, resulting in a panic. The patch addresses this by ensuring that the filled field is updated with the number of bytes read, even when an error is returned, thus preventing the out-of-bounds access.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.