{"id":"CVE-2020-36443","aliases":["EUVD-2021-1730","GHSA-gvcp-948f-8f2p","RUSTSEC-2020-0123"],"status":"published","title":"Use of Uninitialized Resource in libp2p-deflate","description":"An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.0123,"percentile":0.69355,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2020-01-24T12:00:00Z","modified":"2026-06-17T03:15:30Z","fixes":[{"ecosystem":"crates.io","package":"libp2p-deflate","fixed_in":["0.27.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"libp2p-deflate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libp2p-deflate","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.27.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"libp2p-deflate","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.27.1"}]}]}],"products":[{"vendor":"libp2p","product":"libp2p-deflate"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0123.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/libp2p-deflate/RUSTSEC-2020-0123.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36443","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gvcp-948f-8f2p"},{"url":"https://github.com/libp2p/rust-libp2p","tags":["package"]},{"url":"https://crates.io/crates/libp2p-deflate","tags":["package"]},{"url":"https://github.com/libp2p/rust-libp2p/issues/1932","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-36443","description":"An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.","status":"published","published":"2021-08-08T05:17:25Z","modified":"2024-08-04T17:30:07.34Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2021-1730","description":"An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.","status":"published","published":"2021-08-08T05:17:25Z","modified":"2024-08-04T17:30:07Z","updated_at":"2026-11-03T03:07:03.010139Z"}],"ghsa":[{"id":"GHSA-gvcp-948f-8f2p","title":"Use of Uninitialized Resource in libp2p-deflate","description":"An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.","status":"published","published":"2021-08-25T20:59:04Z","modified":"2023-02-01T05:05:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2020-36443","description":"An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.","status":"published","published":"2021-08-08T06:15:07.24Z","modified":"2026-06-17T03:15:30.19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:06:44.292752Z"}],"osv":[{"id":"GHSA-gvcp-948f-8f2p","title":"Use of Uninitialized Resource in libp2p-deflate","description":"An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.","status":"published","published":"2021-08-25T20:59:04Z","modified":"2023-11-08T04:03:45.145642Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"RUSTSEC-2020-0123","title":"Contents of uninitialized memory exposed in DeflateOutput's AsyncRead implementation","description":"Affected versions of this crate passes an uninitialized buffer to a user-provided trait function `AsyncRead::poll_read()`.\n\nArbitrary `AsyncRead::poll_read()` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.\nReading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.\n\nThe flaw was fixed in commit 5ba266a by ensuring the newly allocated part of the buffer is zero-initialized before passing it to a user-provided `AsyncRead::poll_read()`.","status":"published","published":"2020-01-24T12:00:00Z","modified":"2023-11-08T04:03:45.145642Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}