Executive brief
Archives may contain uninitialized memory
Affected products
- crates.io rkyv
Junglewise Threat Intelligence
CVE-2021-31919: RUSTSEC-2021-0054 - Archives may contain uninitialized memory
CVE-2021-31919 · Severity: low · CVSS 3.1 · Published 2021-04-28
Technologies: rkyv (crates.io). Vendors: crates.io.
Related threats
- rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
- rkyv memory corruption via panic-safety bugs in clear functions
- RUSTSEC-2026-0235 - Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
- RUSTSEC-2026-0233 - Crafted archives can cause a use-after-free during deserialization
- RUSTSEC-2026-0234 - Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables