{"id":"CVE-2021-30454","aliases":["EUVD-2021-1603","GHSA-6vmq-jh76-hq43","RUSTSEC-2021-0051"],"status":"published","title":"Uninitialized memory access in outer_cgi","description":"An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01139,"percentile":0.6706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2021-01-31T12:00:00Z","modified":"2026-06-17T03:50:16Z","fixes":[{"ecosystem":"crates.io","package":"outer_cgi","fixed_in":["0.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"outer_cgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"outer_cgi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"outer_cgi","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.2.1"}]}]}],"products":[{"vendor":"outer_cgi_project","product":"outer_cgi"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0051.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30454","tags":["advisory"]},{"url":"https://github.com/SolraBizna/outer_cgi/issues/1","tags":["web","report"]},{"url":"https://github.com/SolraBizna/outer_cgi/commit/dd59b3066e616a08e756f72de8dc3ab11b7036c4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6vmq-jh76-hq43"},{"url":"https://github.com/SolraBizna/outer_cgi","tags":["package"]},{"url":"https://crates.io/crates/outer_cgi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-30454","description":"An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.","status":"published","published":"2021-04-07T21:20:18Z","modified":"2024-08-03T22:32:40.43Z","updated_at":"2026-11-02T14:33:02.20241Z"}],"euvd":[{"id":"EUVD-2021-1603","description":"An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.","status":"published","published":"2021-04-07T21:20:18Z","modified":"2024-08-03T22:32:40Z","updated_at":"2026-11-03T03:24:42.48986Z"}],"ghsa":[{"id":"GHSA-6vmq-jh76-hq43","title":"Uninitialized memory access in outer_cgi","description":"An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.","status":"published","published":"2021-08-25T20:55:25Z","modified":"2023-01-11T05:05:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2021-30454","description":"An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.","status":"published","published":"2021-04-07T22:15:15.117Z","modified":"2026-06-17T03:50:16.51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"GHSA-6vmq-jh76-hq43","title":"Uninitialized memory access in outer_cgi","description":"An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.","status":"published","published":"2021-08-25T20:55:25Z","modified":"2023-11-08T04:05:46.033472Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"RUSTSEC-2021-0051","title":"KeyValueReader passes uninitialized memory to Read instance","description":"The `KeyValueReader` type in affected versions of this crate set up an\nuninitialized memory buffer and passed them to be read in to a user-provided\n`Read` instance.\n\nThe `Read` instance could read uninitialized memory and cause undefined\nbehavior and miscompilations.\n\nThis issue was fixed in commit [dd59b30](https://github.com/SolraBizna/outer_cgi/commit/dd59b3066e616a08e756f72de8dc3ab11b7036c4)\nby zero-initializing the buffers before passing them.","status":"published","published":"2021-01-31T12:00:00Z","modified":"2023-11-08T04:05:46.033472Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}