{"id":"CVE-2021-26305","aliases":["EUVD-2021-1535","GHSA-37jj-wp7g-7wj4","RUSTSEC-2021-0012"],"status":"published","title":"Read of uninitialized memory in cdr","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01708,"percentile":0.77515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2021-01-02T12:00:00Z","modified":"2026-10-24T10:30:42Z","fixes":[{"ecosystem":"crates.io","package":"cdr","fixed_in":["0.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"cdr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cdr","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"cdr","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.4"}]}]}],"products":[{"vendor":"cdr_project","product":"cdr"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0012.html","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26305","tags":["advisory"]},{"url":"https://github.com/hrektts/cdr-rs/issues/10","tags":["web","report"]},{"url":"https://github.com/hrektts/cdr-rs/pull/11","tags":["web"]},{"url":"https://github.com/hrektts/cdr-rs/commit/0e6006de464caa331643f86cd2d9ba3b32b09833","tags":["web"]},{"url":"https://github.com/advisories/GHSA-37jj-wp7g-7wj4"},{"url":"https://github.com/hrektts/cdr-rs","tags":["package"]},{"url":"https://crates.io/crates/cdr","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-26305","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","status":"published","published":"2021-01-29T02:27:42Z","modified":"2024-08-03T20:19:20.13Z","updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-1535","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","status":"published","published":"2021-01-29T02:27:42Z","modified":"2024-08-03T20:19:20Z","updated_at":"2026-11-03T03:24:51.962182Z"}],"ghsa":[{"id":"GHSA-37jj-wp7g-7wj4","title":"Read of uninitialized memory in cdr","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","status":"published","published":"2021-08-25T20:53:12Z","modified":"2023-04-14T19:17:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:36:50.476488Z"}],"nvd":[{"id":"CVE-2021-26305","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","status":"published","published":"2021-01-29T03:15:12.363Z","modified":"2026-06-17T03:43:04.767Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"CVE-2021-26305","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","status":"published","published":"2021-01-29T03:15:12.363Z","modified":"2026-10-24T10:30:42.574506885Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-37jj-wp7g-7wj4","title":"Read of uninitialized memory in cdr","description":"An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.","status":"published","published":"2021-08-25T20:53:12Z","modified":"2023-11-08T04:05:20.783188Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"RUSTSEC-2021-0012","title":"Reading uninitialized memory can cause UB (`Deserializer::read_vec`)","description":"`Deserializer::read_vec()` created an uninitialized buffer and passes it to a user-provided `Read` implementation (`Deserializer.reader.read_exact()`).\n\nPassing an uninitialized buffer to an arbitrary `Read` implementation is currently defined as undefined behavior in Rust. Official documentation for the `Read` trait explains the following: \"It is your responsibility to make sure that buf is initialized before calling read. Calling read with an uninitialized buf (of the kind one obtains via MaybeUninit\u003cT\u003e) is not safe, and can lead to undefined behavior.\"\n\nThe flaw was corrected in commit ce310f7 by zero-initializing the newly allocated buffer before handing it to `Deserializer.reader.read_exact()`.","status":"published","published":"2021-01-02T12:00:00Z","modified":"2023-11-08T04:05:20.783188Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}