Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

smallvec may cause program crashes

CVE-2021-25900 · published 7 days ago
Summary

The smallvec code library used in some Rust projects can trigger crashes or abnormal behavior. This issue has been fixed in newer releases of the smallvec package. Update the smallvec dependency to the latest version to stay safe.

What to do
  • Update simonsapin smallvec to version 0.6.14.
  • Update simonsapin smallvec to version 1.6.1.
  • Update smallvec to version 1.6.0+aikido.1.
Affected software
Ecosystem VendorProductAffected versions
rust simonsapin smallvec >= 0.6.3, < 0.6.14
>= 1.0.0, < 1.6.1
Fix: upgrade to 0.6.14
– servo smallvec >= 0.6.3, < 0.6.14
>= 1.0.0, < 1.6.1
cpe:2.3:a:servo:smallvec:*:*:*:*:*:rust:*:*
Root:Cargo – smallvec < 1.6.0+aikido.1
Fix: upgrade to 1.6.0+aikido.1
Original advisory text
CVE-2021-25900 in smallvec - Patched by Root
Root has patched CVE-2021-25900 in the smallvec package for Root:Cargo. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published6 Oct 2026
Updated7 Oct 2026
First seen6 Mar 2026
Sources
GHSA-43w2-9j62-hq99 · GHSA
CVE-2021-25900 · NVD
ROOT-APP-CARGO-CVE-2021-25900 · OSV
Track software like this
Free during beta