RUSTSEC-2025-0165
i_tree allowed out-of-bounds access through safe public node accessors
Affected versions of i_tree exposed safe public Tree::node and Tree::mut_node methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::get_unchecked / get_unchecked_mut on the internal node buffer, without validating that the index was in bounds.
Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any unsafe code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.
Starting with 0.10.0 the crate was restructured and these accessors are no longer reachable from outside the crate.
What each source reports
OSV No score
i_tree allowed out-of-bounds access through safe public node accessors
Affected versions of i_tree exposed safe public Tree::node and Tree::mut_node methods in the public tree module. These methods accepted an arbitrary u32 index and passed it directly to Vec::get_unchecked / get_unchecked_mut on the internal node buffer, without validating that the index was in bounds.
Because these methods were safe and public, a caller could pass an out-of-bounds index without writing any unsafe code, producing an out-of-bounds shared or mutable reference and triggering undefined behavior.
Starting with 0.10.0 the crate was restructured and these accessors are no longer reachable from outside the crate.
- Record
RUSTSEC-2025-0165- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
i_treecrates.io |
0.0.0-0 up to 0.10.0 | 0.10.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
RUSTSEC-2025-0165 is a vulnerability with no CVSS score yet in i_tree, published July 4, 2025. No source lists public exploit code. Fixed in i_tree 0.10.0.