GitHub Advisoryadvisory · crates.io

GHSA-qx2v-8332-m4fv slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check

MEDIUM Published 2025-08-11 Modified 2025-08-12 Official page ↗
Aliases
CVE-2025-55159
Ecosystem
crates.io
Packages
slab
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-119
Reviewed
2025-08-11

Affected packages

• crates.io slab: >= 0.4.10, < 0.4.11 → fixed in 0.4.11

Description

Impact The `get_disjoint_mut` method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. Patches This has been fixed in slab v0.4.11. Workarounds Avoid using `get_disjoint_mut` with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later. References • https://github.com/tokio-rs/slab/pull/152

Related

Alias · CVE (1)

  • CVE-2025-55159 slab is a pre-allocated storage for a uniform data type. vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References