Most recent entries from all

cnvd-2021-78752

EUVD-2026-48183

fkie_cve-2020-36443

An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.

GHSA-gvcp-948f-8f2p — Use of Uninitialized Resource in libp2p-deflate

Affected: crates.io: libp2p-deflate

An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.

gsd-2020-36443

RUSTSEC-2020-0123 — Contents of uninitialized memory exposed in DeflateOutput's AsyncRead implementation

Affected: crates.io: libp2p-deflate

Affected versions of this crate passes an uninitialized buffer to a user-provided trait function `AsyncRead::poll_read()`.

Arbitrary `AsyncRead::poll_read()` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The flaw was fixed in commit 5ba266a by ensuring the newly allocated part of the buffer is zero-initialized before passing it to a user-provided `AsyncRead::poll_read()`.