CVE-2026-25541 Bytes is vulnerable to integer overflow in BytesMut::reserve
An integer overflow in the Rust bytes library allows attackers to trigger out-of-bounds memory access, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25541?
CVE-2026-25541 is a medium-severity vulnerability in tokio-rs bytes, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.
Weakness: CWE-680
Which versions are affected by CVE-2026-25541?
3 open source packages ship an affected version, including bytes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bytes crates.io | From 1.2.1 | 1.11.1 |
bytes crates.io | From 1.2.1 | 1.11.1 |
bytes crates.io | From 1.2.1 | 1.11.1 |
Linux distribution packages (19)
nm-configurator SUSE:Linux Micro 6.2 | All versions | 0.3.5-160000.1.1 |
nm-configurator openSUSE:Leap 16.0 | All versions | 0.3.5-160000.1.1 |
sequoia-sq openSUSE:Leap 16.0 | All versions | 1.4.0-bp160.1.1 |
supergfxctl openSUSE:Leap 16.0 | All versions | 1762634235.5d503b1-bp160.1.1 |
waylyrics openSUSE:Leap 16.0 | All versions | 0.4.0-bp160.1.1 |
cargo-audit openSUSE:Tumbleweed | All versions | 0.22.2~git0.281452c-2.1 |
cargo-c openSUSE:Tumbleweed | All versions | 0.10.23-2.1 |
forgejo-cli openSUSE:Tumbleweed | All versions | 0.6.0-2.1 |
git-cliff openSUSE:Tumbleweed | All versions | 2.13.1-1.1 |
librepods openSUSE:Tumbleweed | All versions | 0.1.0+git20260515.672e65a-1.1 |
markdown-oxide openSUSE:Tumbleweed | All versions | 0.25.12-1.1 |
nm-configurator openSUSE:Tumbleweed | All versions | 0.3.5-2.1 |
obs-service-cargo openSUSE:Tumbleweed | All versions | 7.2.2-2.1 |
rustup openSUSE:Tumbleweed | All versions | 1.29.0~0-1.1 |
switcheroo openSUSE:Tumbleweed | All versions | 2.6.0-1.1 |
tealdeer openSUSE:Tumbleweed | All versions | 1.8.0-2.1 |
tree-sitter openSUSE:Tumbleweed | All versions | 0.26.8-5.1 |
wasm-bindgen openSUSE:Tumbleweed | All versions | 0.2.100-2.1 |
wild openSUSE:Tumbleweed | All versions | 0.10.0-2.1 |
Products include Tokio-Rs Bytes.
How do I fix CVE-2026-25541?
Upgrade bytes to 1.11.1 or later.
Is CVE-2026-25541 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25541 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-76691, AZL-76703, AZL-76712, AZL-76715, AZL-76718, AZL-76721 and 48 more.