CVE-2020-25791: sized-chunks - Array Size Not Checked in Sized-Chunks
Summary
CVE-2020-25791: Multiple soundness issues in Chunk and InlineArray. Affects sized-chunks versions >= 0.0.0-0, < 0.6.3. Fixed in 0.6.3. How to fix ↓
Also tracked for
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
- rust-sized-chunks · Debian:11
The same CVE-2020-25791 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sized-chunks is a crate for Rust that provides a Chunk implementation. It allows for the creation of chunks with a specified size. The Chunk implementation in sized-chunks does not properly check the array size when constructed with unit().
Vulnerability Detail
The vulnerability in sized-chunks (through version 0.6.2) arises from the lack of array size validation in the Chunk implementation. When constructing a Chunk with unit(), the array size is not properly checked. This oversight can lead to potential memory corruption or other security issues. An attacker could exploit this vulnerability to manipulate the array size and cause unexpected behavior or crashes in applications that utilize sized-chunks.
How To Fix
Latest published version: 0.7.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the dependency to the fixed version.
Conclusion
The vulnerability in sized-chunks (through version 0.6.2) allows for potential memory corruption or other security issues due to the lack of array size validation in the Chunk implementation. To mitigate this vulnerability, developers should update their dependency on sized-chunks to version 0.6.3 or later. It is recommended to stay informed about vulnerabilities in open-source software and consider using tools like Vulert (https://vulert.com) to monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for sized-chunks →
FAQ
sized-chunks is a crate for Rust that provides a Chunk implementation, allowing for the creation of chunks with a specified size.
This vulnerability can lead to potential memory corruption or other security issues. An attacker could exploit this vulnerability to manipulate the array size and cause unexpected behavior or crashes in applications that utilize sized-chunks.
To fix this vulnerability, update your dependency on sized-chunks to version 0.6.3 or later. This version includes the necessary fix to properly validate the array size when constructing a Chunk with unit().
There is no known workaround for this vulnerability. It is recommended to update the dependency to the fixed version.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-9p9m-9xww-qjcx.
References
Related vulnerabilities
Recent vulnerabilities recorded for sized-chunks.
