CVE-2020-35861

Published: Dec 31, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

Affected (1)

Products: Bumpalo Project: Bumpalo

Bumpalo Project

1 product

Bumpalo

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bumpalo Project Bumpalo	From 3.0.0 to 3.2.1

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (2)

https://rustsec.org/advisories/RUSTSEC-2020-0006.html

Source: cve@mitre.org

ExploitPatchThird Party Advisory

https://rustsec.org/advisories/RUSTSEC-2020-0006.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.