CVE-2021-28877

moderate-risk

Published 2021-04-11

In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Rust

Affected Vendors

Rust-Lang

References (4)

Issue Tracking https://github.com/rust-lang/rust/pull/80670

Third Party Advisory https://security.gentoo.org/glsa/202210-09

Issue Tracking https://github.com/rust-lang/rust/pull/80670

Third Party Advisory https://security.gentoo.org/glsa/202210-09

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal