{"id":"CVE-2021-25900","aliases":["DEBIAN-CVE-2021-25900","EUVD-2022-2287","GHSA-43w2-9j62-hq99","MGASA-2021-0234","ROOT-APP-CARGO-CVE-2021-25900","RUSTSEC-2021-0003","SUSE-SU-2021:1408-1","UBUNTU-CVE-2021-25900","openSUSE-SU-2021:0634-1","openSUSE-SU-2024:11593-1"],"status":"published","title":"Buffer overflow in SmallVec::insert_many","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0172,"percentile":0.7777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-01-08T12:00:00Z","modified":"2026-11-11T02:45:09Z","fixes":[{"ecosystem":"crates.io","package":"smallvec","fixed_in":["0.6.14","1.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rust-smallvec","fixed_in":["1.4.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-smallvec","fixed_in":["1.4.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-smallvec","fixed_in":["1.4.2-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"librsvg","fixed_in":["2.45.5-3.2.mga7"],"sources":["osv"]},{"ecosystem":"Root:Cargo","package":"smallvec","fixed_in":["1.6.0+aikido.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"librsvg","fixed_in":["2.46.5-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"librsvg","fixed_in":["2.46.5-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"librsvg","fixed_in":["2.46.5-lp152.2.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.3"},{"fixed":"0.6.14"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.3"},{"fixed":"0.6.14"}]}]},{"source":"osv","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.5-3.2.mga7"}]}]},{"source":"osv","ecosystem":"Root:Cargo","package":"smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0+aikido.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"smallvec","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.3"},{"fixed":"0.6.14"},{"introduced":"1.0.0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.5-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.5-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.10-1","1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-2","1.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-1","1.11.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1-1","1.15.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-smallvec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2-1","1.15.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"librsvg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46.5-lp152.2.3.1"}]}]}],"products":[{"vendor":"servo","product":"smallvec"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0003.html","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25900","tags":["advisory"]},{"url":"https://github.com/servo/rust-smallvec/issues/252","tags":["web","report"]},{"url":"https://github.com/servo/rust-smallvec/commit/5757ac500d4e544485d796b542e4e589749c291b","tags":["web"]},{"url":"https://github.com/servo/rust-smallvec/commit/9998ba0694a6b51aa6604748b00b6a98f0a0039e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-43w2-9j62-hq99"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-25900","tags":["advisory"]},{"url":"https://github.com/servo/rust-smallvec","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0234.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29055","tags":["report"]},{"url":"https://crates.io/crates/smallvec","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211408-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183403","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25900","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-25900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-25900","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJTKYUPH7JWPY376WTC427MFFFZQ7U7L/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-25900","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","status":"published","published":"2021-01-22T09:03:36Z","modified":"2024-08-03T20:11:28.459Z","updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2022-2287","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","status":"published","published":"2021-01-22T09:03:36Z","modified":"2024-08-03T20:11:28Z","updated_at":"2026-11-03T03:24:51.962182Z"}],"ghsa":[{"id":"GHSA-43w2-9j62-hq99","title":"Buffer overflow in SmallVec::insert_many","description":"A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap. This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.\n\nThe flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.","status":"published","published":"2022-05-24T17:40:21Z","modified":"2023-09-18T20:41:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:37:05.567008Z"}],"nvd":[{"id":"CVE-2021-25900","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","status":"published","published":"2021-01-26T18:16:22.27Z","modified":"2026-06-17T03:42:32.73Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"CVE-2021-25900","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","status":"published","published":"2021-01-26T18:16:22.27Z","modified":"2026-11-11T02:45:09.13305792Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-11T02:50:43.46164Z"},{"id":"DEBIAN-CVE-2021-25900","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","status":"published","published":"2021-01-26T18:16:22.27Z","modified":"2026-10-23T18:02:58.11356185Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-43w2-9j62-hq99","title":"Buffer overflow in SmallVec::insert_many","description":"A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap. This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.\n\nThe flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.","status":"published","published":"2022-05-24T17:40:21Z","modified":"2023-11-08T04:05:16.493284Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"RUSTSEC-2021-0003","title":"Buffer overflow in SmallVec::insert_many","description":"A bug in the `SmallVec::insert_many` method caused it to allocate a buffer that was smaller than needed.  It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap.\n\nThis bug was only triggered if the iterator passed to `insert_many` yielded more items than the lower bound returned from its `size_hint` method.\n \nThe flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted.  The fix also simplified the implementation of `insert_many` to use less unsafe code, so it is easier to verify its correctness.\n\nThank you to Yechan Bae ([@Qwaz](https://github.com/Qwaz)) and the Rust group at Georgia Tech’s SSLab for finding and reporting this bug.","status":"published","published":"2021-01-08T12:00:00Z","modified":"2026-07-17T16:00:03.208176448Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2021-25900","description":"An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.","status":"published","published":"2021-01-26T18:16:00Z","modified":"2026-10-17T12:56:58.993252894Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"MGASA-2021-0234","title":"Updated librsvg packages fix a security vulnerability","description":"This update patches the vendored `smallvec` Rust crate in librsvg to fix a security vulnerability:\n\nThe Iterator implementation mishandles destructors, leading to a double free (CVE-2021-25900).\n","status":"published","published":"2021-06-08T14:33:02Z","modified":"2026-04-16T04:44:47.268069846Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0634-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issues:\n\n- librsvg was updated to 2.46.5:\n  * Update dependent crates that had security vulnerabilities:\n    smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2021-25900 (bsc#1183403)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-30T19:22:51Z","modified":"2026-02-04T03:47:30.159641Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11593-1","title":"gdk-pixbuf-loader-rsvg-2.52.2-2.1 on GA media","description":"These are all security issues fixed in the gdk-pixbuf-loader-rsvg-2.52.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:58.945202Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"ROOT-APP-CARGO-CVE-2021-25900","title":"CVE-2021-25900 in smallvec - Patched by Root","description":"Root has patched CVE-2021-25900 in the smallvec package for Root:Cargo. Multiple fixed versions available.","status":"published","published":"2026-10-06T14:22:02Z","modified":"2026-10-06T15:15:07.112399924Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2021:1408-1","title":"Security update for librsvg","description":"This update for librsvg fixes the following issues:\n\n- librsvg was updated to 2.46.5:\n  * Update dependent crates that had security vulnerabilities:\n    smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2021-25900 (bsc#1183403)\n","status":"published","published":"2021-04-28T14:32:09Z","modified":"2026-02-04T03:45:32.220423Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}