CVE-2025-55159 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Attackers can trigger undefined behavior or crashes in applications using the slab library by exploiting an incorrect bounds check in get_disjoint_mut.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55159?
CVE-2025-55159 is a medium-severity memory corruption vulnerability in tokio-rs slab, published on 11 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.
Weakness: CWE-119
Which versions are affected by CVE-2025-55159?
3 open source packages ship an affected version, including slab.
| Package | Affected | Fixed in |
|---|---|---|
slab crates.io | From 0.4.10 | 0.4.11 |
slab crates.io | From 0.4.10 | 0.4.11 |
slab crates.io | From 0.4.10 | 0.4.11 |
Linux distribution packages (37)
rust-keylime SUSE:Linux Enterprise Micro 5.3 | All versions | 0.2.8+12-150400.3.10.1 |
rust-keylime SUSE:Linux Enterprise Micro 5.4 | All versions | 0.2.8+12-150400.3.8.1 |
rust-keylime SUSE:Linux Enterprise Micro 5.5 | All versions | 0.2.8+12-150500.3.8.1 |
SLES16-Migration SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.1.26-15.22.4 |
python-Cerberus SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.3.2-150700.20.2.10 |
suse-migration-services SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.1.26-150700.16.12.1 |
suse-migration-sle16-activation SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.1.26-150700.15.9.1 |
wicked2nm SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.4.0-150700.15.7.2 |
sccache SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 0.4.2~4-150600.10.6.1 |
sccache SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 0.4.2~4-150600.10.6.1 |
SLES16-SAP_Migration SUSE:Linux Enterprise Module for SAP Applications 15 SP7 | All versions | 2.1.26-15.14.4 |
flake-pilot SUSE:Linux Enterprise Server 16.0 | All versions | 3.1.22-160000.1.1 |
flake-pilot SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.1.22-160000.1.1 |
gstreamer SUSE:Linux Micro 6.2 | All versions | 1.26.7-160000.1.1 |
gstreamer-plugins-base SUSE:Linux Micro 6.2 | All versions | 1.26.7-160000.1.1 |
sccache openSUSE:Leap 15.6 | All versions | 0.4.2~4-150600.10.6.1 |
flake-pilot openSUSE:Leap 16.0 | All versions | 3.1.22-160000.1.1 |
gstreamer openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-devtools openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-docs openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-plugins-bad openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-plugins-base openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-plugins-good openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-plugins-libav openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-plugins-rs openSUSE:Leap 16.0 | All versions | 1.26.7+git0.6ab75814-160000.1.1 |
gstreamer-plugins-ugly openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
gstreamer-rtsp-server openSUSE:Leap 16.0 | All versions | 1.26.7-160000.1.1 |
ab-av1 openSUSE:Tumbleweed | All versions | 0.11.7-1.1 |
afterburn openSUSE:Tumbleweed | All versions | 5.10.0.git73.b97f772-2.1 |
aws-efs-utils openSUSE:Tumbleweed | All versions | 2.3.3-1.1 |
flake-pilot openSUSE:Tumbleweed | All versions | 3.1.21-1.1 |
fractal openSUSE:Tumbleweed | All versions | 12.0-3.1 |
framework_tool openSUSE:Tumbleweed | All versions | 0.4.5-2.1 |
git-cliff openSUSE:Tumbleweed | All versions | 2.12.0-1.1 |
gstreamer-devtools openSUSE:Tumbleweed | All versions | 1.26.5-1.1 |
gstreamer-plugins-rs openSUSE:Tumbleweed | All versions | 1.26.5+git11.949807a4-1.1 |
rust-keylime openSUSE:Tumbleweed | All versions | 0.2.8+12-1.1 |
How do I fix CVE-2025-55159?
Upgrade slab to 0.4.11 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-55159 being exploited?
There is no known exploitation of CVE-2025-55159 in the wild and no public exploit code.
Sources
Also known as AZL-74897, GHSA-qx2v-8332-m4fv, OESA-2026-2817, OESA-2026-2818, OESA-2026-2819, OESA-2026-3047 and 25 more.