CVE-2021-30454
Uninitialized memory access in outer_cgi
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
- Record
CVE-2021-30454- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
- Record
CVE-2021-30454- Updated
- 2026-11-02
EUVDEUVD-2021-1603 No score
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
- Record
EUVD-2021-1603- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6vmq-jh76-hq43
Uninitialized memory access in outer_cgi
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
- Record
GHSA-6vmq-jh76-hq43- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVGHSA-6vmq-jh76-hq43
Uninitialized memory access in outer_cgi
An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
- Record
GHSA-6vmq-jh76-hq43- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0051
KeyValueReader passes uninitialized memory to Read instance
The KeyValueReader type in affected versions of this crate set up an
uninitialized memory buffer and passed them to be read in to a user-provided
Read instance.
The Read instance could read uninitialized memory and cause undefined
behavior and miscompilations.
This issue was fixed in commit dd59b30 by zero-initializing the buffers before passing them.
- Record
RUSTSEC-2021-0051- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-30454 is a critical vulnerability (CVSS 9.8) in Outer Cgi Project Cgi, published January 31, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in outer_cgi 0.2.1.
References
rustsec.org/advisories/RUSTSEC-2021-0051.html
nvd.nist.gov/vuln/detail/CVE-2021-30454
github.com/SolraBizna/outer_cgi/issues/1
crates.io/crates/outer_cgi