Integer Overflow Vulnerability in Bytes Package: A Risk to Memory Safety
Summary
RUSTSEC-2026-0007: Integer overflow in BytesMut::reserve. Affects bytes versions >= 1.2.1, < 1.11.1. Fixed in 1.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'bytes' package is a widely used Rust library that provides utilities for working with byte arrays, including the 'BytesMut' type, which allows for dynamic byte buffer manipulation. This package is essential for applications that require efficient handling of binary data. However, a recent vulnerability has been identified in the 'reserve' function of 'BytesMut', which can lead to memory corruption and undefined behavior if not addressed promptly.
Vulnerability Detail
The vulnerability arises from an integer overflow in the 'BytesMut::reserve' function. Specifically, the condition that checks if the current capacity is sufficient uses an unchecked addition, which can lead to an overflow when the sum of 'new_cap' and 'offset' exceeds the maximum value of 'usize'. In release builds, this unchecked overflow wraps around, allowing the condition to incorrectly pass and set 'self.cap' to a value greater than the actual allocated capacity. This can result in out-of-bounds memory access when subsequent functions, such as 'spare_capacity_mut()', rely on this corrupted capacity value, leading to potential memory corruption and undefined behavior.
How To Fix
Latest published version: 1.12.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, ensure that integer overflow checks are configured to panic instead of wrapping. This can be done by running your application in debug mode, which will trigger a panic on overflow. Here is a code snippet demonstrating the issue and how it can be triggered:
use bytes::*;
fn main() {
let mut a = BytesMut::from(&b"hello world"[..]);
let mut b = a.split_off(5);
// Ensure b becomes the unique owner of the backing storage
drop(a);
// Trigger overflow in new_cap + offset inside reserve
b.reserve(usize::MAX - 6);
// This call relies on the corrupted cap and may cause UB & HBO
b.put_u8(b'h');
}
Conclusion
The integer overflow vulnerability in the 'bytes' package poses a significant risk to memory safety in applications that utilize the 'BytesMut' type. It is crucial to update to the patched version 1.11.1 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for bytes →
FAQ
The vulnerability is an integer overflow in the 'BytesMut::reserve' function, which can lead to memory corruption.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
If exploited, this vulnerability can lead to undefined behavior, memory corruption, and potential security risks in your application.
Yes, the vulnerability has been patched in version 1.11.1 of the 'bytes' package. Updating to this version will resolve the issue.
As a temporary workaround, ensure that integer overflow checks are configured to panic by running your application in debug mode.
References
Related vulnerabilities
Recent vulnerabilities recorded for bytes.
