CVE-2021-45697
The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
- Record
CVE-2021-45697- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
- Record
CVE-2021-45697- Updated
- 2026-11-02
EUVDEUVD-2022-0483 No score
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
- Record
EUVD-2022-0483- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6p3c-v8vc-c244
The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
- Record
GHSA-6p3c-v8vc-c244- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-82hm-vh7g-hrh9 No score
Partial read is incorrect in molecule
Impact
Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
Workarounds
If you already have the whole FixVec A, you can use A.as_slice().len() to get the total size of the FixVec.
For more information
If you have any questions or comments about this advisory:
- Record
GHSA-82hm-vh7g-hrh9- Updated
- 2026-11-02
OSV
An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
- Record
CVE-2021-45697- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-6p3c-v8vc-c244
The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
- Record
GHSA-6p3c-v8vc-c244- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-82hm-vh7g-hrh9 No score
Partial read is incorrect in molecule
Impact
Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
Workarounds
If you already have the whole FixVec A, you can use A.as_slice().len() to get the total size of the FixVec.
For more information
If you have any questions or comments about this advisory:
- Record
GHSA-82hm-vh7g-hrh9- Updated
- 2026-11-02
OSVRUSTSEC-2021-0103 No score
Partial read is incorrect in molecule
Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
- Record
RUSTSEC-2021-0103- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45697 is a critical vulnerability (CVSS 9.8) in Nervos Molecule, published July 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in molecule 0.7.2.
References
rustsec.org/advisories/RUSTSEC-2021-0103.html
raw.githubusercontent.com/rustsec/advisory-db/main/crates/molecule/RUSTSEC-2021-0103.md
nvd.nist.gov/vuln/detail/CVE-2021-45697
github.com/nervosnetwork/molecule/pull/49
crates.io/crates/molecule