CVE-2021-28029
Uninitialized memory access in toodee
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
- Record
CVE-2021-28029- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
- Record
CVE-2021-28029- Updated
- 2026-11-02
EUVDEUVD-2021-2133 No score
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
- Record
EUVD-2021-2133- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xm9m-2vj8-fmfr
Uninitialized memory access in toodee
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
- Record
GHSA-xm9m-2vj8-fmfr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVGHSA-wcvp-r8j8-47pc
Double free in toodee
When inserting rows from an iterator at a particular index, toodee would shift items over, duplicating their ownership. The space reserved for the new elements was based on the len() returned by the ExactSizeIterator.
This could result in elements in the array being freed twice if the iterator panics. Uninitialized or previously freed elements could also be exposed if the len() didn't match the number of elements.
These issues were fixed in commit ced70c17 by temporarily setting the length of the array smaller while processing it and adding assertions on the number of elements returned by the iterator.
- Record
GHSA-wcvp-r8j8-47pc- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVGHSA-xm9m-2vj8-fmfr
Uninitialized memory access in toodee
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
- Record
GHSA-xm9m-2vj8-fmfr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0028 No score
Multiple memory safety issues in insert_row
When inserting rows from an iterator at a particular index, toodee would shift
items over, duplicating their ownership. The space reserved for the new elements
was based on the len() returned by the ExactSizeIterator.
This could result in elements in the array being freed twice if the iterator
panics. Uninitialized or previously freed elements could also be exposed if the
len() didn't match the number of elements.
These issues were fixed in commit ced70c17 by temporarily setting the length
of the array smaller while processing it and adding assertions on the number
of elements returned by the iterator.
- Record
RUSTSEC-2021-0028- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28029 is a high vulnerability (CVSS 7.5) in Toodee Project Toodee, published February 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in toodee 0.3.0.
References
rustsec.org/advisories/RUSTSEC-2021-0028.html
nvd.nist.gov/vuln/detail/CVE-2021-28029
github.com/antonmarsden/toodee/issues/13
crates.io/crates/toodee