{"id":"CVE-2021-27377","aliases":["EUVD-2021-1651","GHSA-9658-c26v-7qvf","RUSTSEC-2021-0022"],"status":"published","title":"Use-after-free in yottadb","description":"An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01355,"percentile":0.71984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-02-09T12:00:00Z","modified":"2026-06-17T03:44:44Z","fixes":[{"ecosystem":"crates.io","package":"yottadb","fixed_in":["1.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"yottadb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"yottadb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"yottadb","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.2.0"}]}]}],"products":[{"vendor":"yottadb","product":"yottadb"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0022.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27377","tags":["advisory"]},{"url":"https://gitlab.com/YottaDB/Lang/YDBRust/-/issues/40","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-9658-c26v-7qvf"},{"url":"https://gitlab.com/YottaDB/Lang/YDBRust","tags":["package"]},{"url":"https://crates.io/crates/yottadb","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-27377","description":"An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.","status":"published","published":"2021-02-18T03:35:20Z","modified":"2024-08-03T20:48:16.468Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-1651","description":"An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.","status":"published","published":"2021-02-18T03:35:20Z","modified":"2024-08-03T20:48:16Z","updated_at":"2026-11-03T03:24:49.368497Z"}],"ghsa":[{"id":"GHSA-9658-c26v-7qvf","title":"Use-after-free in yottadb","description":"An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.","status":"published","published":"2021-08-25T20:55:30Z","modified":"2023-01-11T05:05:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2021-27377","description":"An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.","status":"published","published":"2021-02-18T04:15:11.763Z","modified":"2026-06-17T03:44:44.203Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"GHSA-9658-c26v-7qvf","title":"Use-after-free in yottadb","description":"An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.","status":"published","published":"2021-08-25T20:55:30Z","modified":"2023-11-08T04:05:24.490347Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"RUSTSEC-2021-0022","title":"Use-after-free in `subscript_next` and `subscript_prev` wrappers","description":"Affected versions of this crate had an unsound implementation which could pass\na pointer to freed memory to `ydb_subscript_next_st` and\n`ydb_subscript_prev_st` if the variable and subscripts did not have enough\nmemory allocated on the first call to hold the next variable in the database.\n\nFor example, the following code had undefined behavior:\n\n```rust\nlet mut key = Key::variable(String::from(\"a\"));\nKey::variable(\"averylongkeywithlotsofletters\")\n    .set_st(YDB_NOTTP, Vec::new(), b\"some val\")\n    .unwrap();\nkey.sub_next_self_st(YDB_NOTTP, Vec::new()).unwrap();\n```\n\n`yottadb` has no reverse-dependencies on crates.io and there are no known\ninstances of this API being used incorrectly in practice. The fix is backwards\ncompatible.\n\nThe flaw was corrected by recalculating the pointer each time it was reallocated.","status":"published","published":"2021-02-09T12:00:00Z","modified":"2023-11-08T04:05:24.490347Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}