{"id":"CVE-2021-45687","aliases":["EUVD-2022-0714","GHSA-jf5h-cf95-w759","GHSA-w428-f65r-h4q2","RUSTSEC-2021-0089"],"status":"published","title":"Optional `Deserialize` implementations lacking validation","description":"An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.0116,"percentile":0.67583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-502"],"published":"2021-01-20T12:00:00Z","modified":"2026-06-17T04:13:56Z","fixes":[{"ecosystem":"crates.io","package":"raw-cpuid","fixed_in":["9.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"raw-cpuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"9.1.1"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"raw-cpuid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"9.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"raw-cpuid","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"9.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"raw-cpuid","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"9.1.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"raw-cpuid","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.1-0"},{"fixed":"9.1.1"}]}]}],"products":[{"vendor":"raw-cpuid_project","product":"raw-cpuid"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0089.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/raw-cpuid/RUSTSEC-2021-0089.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/gz/rust-cpuid/issues/43","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-jf5h-cf95-w759"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45687","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w428-f65r-h4q2"},{"url":"https://github.com/gz/rust-cpuid","tags":["package"]},{"url":"https://crates.io/crates/raw-cpuid","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-45687","description":"An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.","status":"published","published":"2021-12-26T21:51:59Z","modified":"2024-08-04T04:47:02.388Z","updated_at":"2026-11-02T14:33:02.930115Z"}],"euvd":[{"id":"EUVD-2022-0714","description":"An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.","status":"published","published":"2021-12-26T21:51:59Z","modified":"2024-08-04T04:47:02Z","updated_at":"2026-11-03T03:08:25.77408Z"}],"ghsa":[{"id":"GHSA-w428-f65r-h4q2","title":"Deserialization of Untrusted Data in rust-cpuid","description":"An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.","status":"published","published":"2022-01-06T22:13:12Z","modified":"2023-06-13T20:25:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:36:54.225318Z"},{"id":"GHSA-jf5h-cf95-w759","title":"Optional `Deserialize` implementations lacking validation","description":"When activating the non-default feature `serialize`, most structs implement\n`serde::Deserialize` without sufficient validation. This allows breaking\ninvariants in safe code, leading to:\n\n* Undefined behavior in `as_string()` methods (which use\n  `std::str::from_utf8_unchecked()` internally).\n* Panics due to failed assertions.\n\nSee https://github.com/gz/rust-cpuid/issues/43.\n","status":"published","published":"2022-06-17T00:16:24Z","modified":"2023-06-13T20:09:45Z","updated_at":"2026-11-02T14:36:53.654352Z"}],"nvd":[{"id":"CVE-2021-45687","description":"An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.","status":"published","published":"2021-12-27T00:15:09.123Z","modified":"2026-06-17T04:13:56.937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:02.977492Z"}],"osv":[{"id":"GHSA-w428-f65r-h4q2","title":"Deserialization of Untrusted Data in rust-cpuid","description":"An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.","status":"published","published":"2022-01-06T22:13:12Z","modified":"2023-11-08T04:07:21.872047Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"GHSA-jf5h-cf95-w759","title":"Optional `Deserialize` implementations lacking validation","description":"When activating the non-default feature `serialize`, most structs implement\n`serde::Deserialize` without sufficient validation. This allows breaking\ninvariants in safe code, leading to:\n\n* Undefined behavior in `as_string()` methods (which use\n  `std::str::from_utf8_unchecked()` internally).\n* Panics due to failed assertions.\n\nSee https://github.com/gz/rust-cpuid/issues/43.\n","status":"published","published":"2022-06-17T00:16:24Z","modified":"2023-11-08T04:07:21.872047Z","updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"RUSTSEC-2021-0089","title":"Optional `Deserialize` implementations lacking validation","description":"When activating the non-default feature `serialize`, most structs implement\n`serde::Deserialize` without sufficient validation. This allows breaking\ninvariants in safe code, leading to:\n\n* Undefined behavior in `as_string()` methods (which use\n  `std::str::from_utf8_unchecked()` internally).\n* Panics due to failed assertions.\n\nSee https://github.com/gz/rust-cpuid/issues/43.","status":"published","published":"2021-01-20T12:00:00Z","modified":"2023-11-08T04:07:21.872047Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}