CVE-2021-45685: columnar - Read on uninitialized buffer may cause UB
Summary
CVE-2021-45685: columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec()). Affects columnar versions >= 0.0.0-0, < 0.1.0. Fixed in 0.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The columnar crate is a library available on crates.io that provides functionality for working with columnar data. It allows users to read and write data in a columnar format, which can be more efficient for certain operations. However, versions of this crate prior to 0.0.0-0 are affected by a vulnerability that can lead to undefined behavior (UB) when performing a Read operation on an uninitialized buffer.
Vulnerability Detail
The vulnerability in the columnar crate arises from passing an uninitialized buffer to a user-provided Read implementation (ColumnarReadExt::read_typed_vec()). This allows arbitrary Read implementations to read from the uninitialized buffer, potentially exposing sensitive memory contents. Additionally, the Read implementation can return an incorrect number of bytes written to the buffer, leading to further issues. Reading from uninitialized memory can result in undefined values and invoke undefined behavior, posing a significant security risk.
How To Fix
Latest published version: 0.13.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid using the ColumnarReadExt::read_typed_vec() function or ensure that the buffer passed to it is properly initialized before calling the function. By initializing the buffer with valid data, the risk of memory exposure and undefined behavior can be mitigated.
Conclusion
The columnar crate prior to version 0.0.0-0 is vulnerable to a read on uninitialized buffer issue, which can lead to memory exposure and undefined behavior. It is crucial for developers to update their dependencies to a patched version of the crate to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for columnar →
FAQ
This vulnerability can lead to memory exposure and undefined behavior, which can be exploited by attackers to read sensitive information or cause the application to behave unpredictably.
Yes, all versions prior to 0.0.0-0 are affected by this vulnerability.
No, a CVSS score is not available for this vulnerability as it is categorized as 'unsound' in the advisory.
More information about this vulnerability can be found in the advisory on the RustSec advisory database: https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2021-0087.json
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your Cargo.lock file without requiring any signup or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for columnar.
