CVE-2020-25791: sized-chunks - Array Size Not Checked in Chunk Implementation
Summary
CVE-2020-25791: Array size is not checked in sized-chunks. Affects sized-chunks versions < 0.6.3. Fixed in 0.6.3. How to fix ↓
Also tracked for
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
The same CVE-2020-25791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sized-chunks is a crate for Rust that provides functionality for working with sized chunks of data. It allows users to create and manipulate chunks of a specified size. The vulnerability affects versions up to 0.6.2 of the crate. The Chunk implementation in sized-chunks does not properly check the array size when constructed with unit().
Vulnerability Detail
The vulnerability in sized-chunks allows an attacker to create a Chunk with an invalid array size. This can lead to various issues, such as buffer overflows or memory corruption. An attacker could potentially exploit this vulnerability to execute arbitrary code, cause a denial of service, or gain unauthorized access to sensitive information.
How To Fix
Latest published version: 0.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to update to the fixed version of the sized-chunks crate.
Conclusion
The vulnerability in sized-chunks allows for potential code execution, denial of service, or unauthorized access to sensitive information. It is crucial to update to the fixed version of the sized-chunks crate (0.6.3 or later) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for sized-chunks →
FAQ
sized-chunks is a Rust crate that provides functionality for working with sized chunks of data. It allows users to create and manipulate chunks of a specified size.
The vulnerability in sized-chunks can lead to buffer overflows, memory corruption, arbitrary code execution, denial of service, or unauthorized access to sensitive information.
To fix the vulnerability, update the sized-chunks crate to version 0.6.3 or later. Modify the Cargo.toml file and run the cargo update command.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the sized-chunks crate.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-9p9m-9xww-qjcx/GHSA-9p9m-9xww-qjcx.json
Related vulnerabilities
Recent vulnerabilities recorded for sized-chunks.
