Most recent entries from all

EUVD-2026-57131

2026-10-19T13:42:48.815047+00:00

EUVD-2026-57131

fkie_cve-2019-15552

2026-10-19T13:42:48.815083+00:00

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.

GHSA-rpcm-whqc-jfw8 — Use after free in libflate

2026-10-19T13:42:48.815115+00:00

Affected: crates.io: libflate

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.

gsd-2019-15552

2026-10-19T13:42:48.815138+00:00

gsd-2019-15552

RUSTSEC-2019-0010 — MultiDecoder::read() drops uninitialized memory of arbitrary type on panic in client code

2026-10-19T13:42:48.815150+00:00

Affected: crates.io: libflate

Affected versions of libflate have set a field of an internal structure with a generic type to an uninitialized value in `MultiDecoder::read()` and reverted it to the original value after the function completed. However, execution of `MultiDecoder::read()` could be interrupted by a panic in caller-supplied `Read` implementation. This would cause `drop()` to be called on uninitialized memory of a generic type implementing `Read`.

This is equivalent to a use-after-free vulnerability and could allow an attacker to gain arbitrary code execution.

The flaw was corrected by aborting immediately instead of unwinding the stack in case of panic within `MultiDecoder::read()`. The issue was discovered and fixed by Shnatsel.

Withdrawn: UBUNTU-CVE-2019-15552

2026-10-19T13:42:48.815175+00:00

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: rust-libflate

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.