bytes has integer overflow in BytesMut::reserve

# Details In the unique reclaim path of `BytesMut::reserve`, the condition ```rs if v_capacity >= new_cap + offset ``` uses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. ## PoC ```rs use bytes::*; fn main() { let mut a = BytesMut::from(&b"hello world"[..]); let mut b = a.split_off(5); // Ensure b becomes the unique owner of the backing storage drop(a); // Trigger overflow in new_cap + offset inside reserve b.reserve(usize::MAX - 6); // This call relies on the corrupted cap and may cause UB & HBO b.put_u8(b'h'); } ``` # Workarounds Users of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply. This vulnerability is also known as [RUSTSEC-2026-0007](https://rustsec.org/advisories/RUSTSEC-2026-0007.html).

Source published

3 Feb 2026 19:17:46 UTC

Source modified

10 Sep 2026 03:50:33 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Publisher rating · MODERATE