{"id":"EUVD-2025-24190","revision":"bd1828a9ee9a412586656be724c593a7","records":[{"revision":"bd1828a9ee9a412586656be724c593a7","observedAt":"2026-11-09T03:11:10.937+00:00","statement":{"source":"euvd","id":"EUVD-2025-24190","aliases":["CVE-2025-55159","GHSA-qx2v-8332-m4fv"],"title":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This coul…","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.1,"severity":null}],"references":["https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv","https://github.com/tokio-rs/slab/pull/152","https://github.com/tokio-rs/slab/commit/2d65c514bc964b192bab212ddf3c1fcea4ae96b8"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24190","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 11, 2025, 11:00:58 PM","dateUpdated":"Aug 12, 2025, 2:07:00 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15475-1","title":"flake-pilot-3.1.21-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2025:20921-1","title":"Recommended update of flake-pilot","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-RU-2025:4131-1","title":"Recommended update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2026:20364-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2025-55159","CVE-2025-58266","CVE-2026-25727"]},{"id":"openSUSE-SU-2026:20329-1","title":"Security update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2025:02957-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15470-1","title":"wicked2nm-1.2.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"msrc_CVE-2025-55159","title":"slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15444-1","title":"framework_tool-0.4.5-2.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2026:21134-1","title":"Security update for glycin-loaders","vulnerabilityIds":["CVE-2025-55159","CVE-2025-58160"]},{"id":"SUSE-SU-2026:20686-1","title":"Security update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15554-1","title":"watchexec-2.3.2-2.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2025:02961-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2026:22302-1","title":"Security update for glycin-loaders","vulnerabilityIds":["CVE-2025-55159","CVE-2025-58160"]},{"id":"openSUSE-SU-2026:12171-1","title":"ab-av1-0.11.7-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025-20013-1","title":"Recommended update of flake-pilot","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2025:3954-1","title":"Security update for aws-efs-utils","vulnerabilityIds":["CVE-2020-35881","CVE-2025-55159"]},{"id":"SUSE-SU-2025:20717-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-58266","CVE-2025-3416","CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15480-1","title":"keylime-ima-policy-0.2.8+12-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2025:02962-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15497-1","title":"scx-1.0.15-2.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2026:21560-1","title":"Security update for kak-lsp","vulnerabilityIds":["CVE-2025-3416","CVE-2025-55159","CVE-2026-25541"]},{"id":"openSUSE-SU-2026:21584-1","title":"Security update for git-cliff","vulnerabilityIds":["CVE-2025-55159","CVE-2026-25541"]},{"id":"openSUSE-SU-2026:11475-1","title":"kak-lsp-21.0.2-1.1 on GA media","vulnerabilityIds":["CVE-2025-3416","CVE-2025-55159","CVE-2026-25541"]},{"id":"openSUSE-SU-2025:15492-1","title":"fractal-12.0-3.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15445-1","title":"gstreamer-devtools-1.26.5-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15461-1","title":"aws-efs-utils-2.3.3-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:20013-1","title":"Recommended update of flake-pilot","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2025:15447-1","title":"jasper-4.2.8-2.1 on GA media","vulnerabilityIds":["CVE-2025-8835","CVE-2025-8836","CVE-2025-8837"]},{"id":"openSUSE-SU-2026:21605-1","title":"Security update for forgejo-cli","vulnerabilityIds":["CVE-2025-3416","CVE-2025-55159","CVE-2026-25541"]},{"id":"openSUSE-SU-2025:15446-1","title":"gstreamer-plugins-rs-1.26.5+git11.949807a4-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2026:11324-1","title":"afterburn-5.10.0.git73.b97f772-2.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]},{"id":"SUSE-SU-2026:20744-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2025-55159","CVE-2025-58266","CVE-2026-25727"]},{"id":"SUSE-SU-2025:20858-1","title":"Security update for rust-keylime","vulnerabilityIds":["CVE-2024-12224","CVE-2024-43806","CVE-2024-58266","CVE-2025-3416","CVE-2025-55159"]},{"id":"SUSE-SU-2025:3944-1","title":"Security update for sccache","vulnerabilityIds":["CVE-2025-55159"]},{"id":"openSUSE-SU-2026:10496-1","title":"git-cliff-2.12.0-1.1 on GA media","vulnerabilityIds":["CVE-2025-55159"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-24190","identifiers":["EUVD-2025-24190","CVE-2025-55159","GHSA-qx2v-8332-m4fv"]},"retained":false,"historicalAffected":[]}],"coverage":[]}