{"id":"CVE-2020-35861","aliases":["DEBIAN-CVE-2020-35861","EUVD-2021-1902","GHSA-vqx7-pw4r-29rr","RUSTSEC-2020-0006","UBUNTU-CVE-2020-35861"],"status":"published","title":"Out of bounds read in bumpalo","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01509,"percentile":0.74639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-03-24T12:00:00Z","modified":"2026-10-26T12:00:52Z","fixes":[{"ecosystem":"crates.io","package":"bumpalo","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rust-bumpalo","fixed_in":["3.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-bumpalo","fixed_in":["3.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-bumpalo","fixed_in":["3.2.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"bumpalo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-bumpalo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-bumpalo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-bumpalo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"bumpalo","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"bumpalo","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-bumpalo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-3","2.6.0-1","3.1.2-1"]}],"products":[{"vendor":"bumpalo_project","product":"bumpalo"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0006.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35861","tags":["advisory"]},{"url":"https://github.com/fitzgen/bumpalo/issues/69","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-vqx7-pw4r-29rr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35861","tags":["advisory"]},{"url":"https://github.com/fitzgen/bumpalo","tags":["package"]},{"url":"https://crates.io/crates/bumpalo","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-35861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35861","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-35861","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2020-12-31T08:30:10Z","modified":"2024-08-04T17:16:12.545Z","updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2021-1902","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2020-12-31T08:30:10Z","modified":"2024-08-04T17:16:12Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-vqx7-pw4r-29rr","title":"Out of bounds read in bumpalo","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2021-08-25T20:47:13Z","modified":"2023-01-11T05:06:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2020-35861","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2020-12-31T10:15:14.987Z","modified":"2026-06-17T03:14:29.013Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35861","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2020-12-31T10:15:14.987Z","modified":"2026-10-24T10:30:48.451605286Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35861","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2020-12-31T10:15:14.987Z","modified":"2026-10-26T12:00:52.034521484Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-vqx7-pw4r-29rr","title":"Out of bounds read in bumpalo","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2021-08-25T20:47:13Z","modified":"2023-11-08T04:03:36.095714Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"RUSTSEC-2020-0006","title":"Flaw in `realloc` allows reading unknown memory","description":"When `realloc`ing, if we allocate new space, we need to copy the old\nallocation's bytes into the new space. There are `old_size` number of bytes in\nthe old allocation, but we were accidentally copying `new_size` number of bytes,\nwhich could lead to copying bytes into the realloc'd space from past the chunk\nthat we're bump allocating out of, from unknown memory.\n\nIf an attacker can cause `realloc`s, and can read the `realoc`ed data back,\nthis could allow them to read things from other regions of memory that they\nshouldn't be able to. For example, if some crypto keys happened to live in\nmemory right after a chunk we were bump allocating out of, this could allow\nthe attacker to read the crypto keys.\n\nBeyond just fixing the bug and adding a regression test, I've also taken two\nadditional steps:\n\n1. While we were already running the testsuite under `valgrind` in CI, because\n   `valgrind` exits with the same code that the program did, if there are\n   invalid reads/writes that happen not to trigger a segfault, the program can\n   still exit OK and we will be none the wiser. I've enabled the\n   `--error-exitcode=1` flag for `valgrind` in CI so that tests eagerly fail\n   in these scenarios.\n\n2. I've written a quickcheck test to exercise `realloc`. Without the bug fix\n   in this patch, this quickcheck immediately triggers invalid reads when run\n   under `valgrind`. We didn't previously have quickchecks that exercised\n   `realloc` because `realloc` isn't publicly exposed directly, and instead\n   can only be indirectly called. This new quickcheck test exercises `realloc`\n   via `bumpalo::collections::Vec::resize` and\n   `bumpalo::collections::Vec::shrink_to_fit` calls.","status":"published","published":"2020-03-24T12:00:00Z","modified":"2023-11-08T04:03:36.095714Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2020-35861","description":"An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.","status":"published","published":"2020-12-31T10:15:00Z","modified":"2025-10-24T04:48:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"}]}}