CVE-2021-45706
Memory flaw in zeroize_derive
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Record
CVE-2021-45706- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-459
- Updated
- 2026-11-02
CVE ListNo score
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Record
CVE-2021-45706- Updated
- 2026-11-02
EUVDEUVD-2022-0554No score
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Record
EUVD-2022-0554- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5hx-w945-j4pq
Memory flaw in zeroize_derive
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Record
GHSA-c5hx-w945-j4pq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
OSVGHSA-c5hx-w945-j4pq
Memory flaw in zeroize_derive
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Record
GHSA-c5hx-w945-j4pq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
OSVRUSTSEC-2021-0115No score
`#[zeroize(drop)]` doesn't implement `Drop` for `enum`s
Affected versions of this crate did not implement Drop when #[zeroize(drop)] was used on an enum.
This can result in memory not being zeroed out after dropping it, which is exactly what is intended when adding this attribute.
The flaw was corrected in version 1.2 and #[zeroize(drop)] on enums now properly implements Drop.
- Record
RUSTSEC-2021-0115- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zeroize_derivecrates.io | before 1.1.1 | 1.1.1 |
zeroize_derivecrates.io | 0.0.0-0 up to 1.1.1 | 1.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45706 is a critical vulnerability (CVSS 9.8) in Zeroize Derive Project Derive, published September 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in zeroize_derive 1.1.1.
References
rustsec.org/advisories/RUSTSEC-2021-0115.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/zeroize_derive/RUSTSEC-2021-0115.md
nvd.nist.gov/vuln/detail/CVE-2021-45706
github.com/iqlusioninc/crates/issues/876
crates.io/crates/zeroize_derive