{"cve":"CVE-2020-25792","nvd":{"published":"2020-09-19T21:15:12.267","modified":"2026-06-17T03:07:18.803","status":"Modified","description":"An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair().","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-129"],"references":["https://github.com/bodil/sized-chunks/commit/3ae48bd463c1af41c24b96b84079946f51f51e3c","https://github.com/bodil/sized-chunks/issues/11","https://rustsec.org/advisories/RUSTSEC-2020-0041.html","https://github.com/bodil/sized-chunks/commit/3ae48bd463c1af41c24b96b84079946f51f51e3c","https://github.com/bodil/sized-chunks/issues/11"],"products":["sized-chunks_project:sized-chunks"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-25792","score":0.02921,"percentile":0.87036,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-64gv-qg2v-vxv6","url":"https://osv.dev/vulnerability/GHSA-64gv-qg2v-vxv6","summary":"Array size is not checked in sized-chunks","modified":"2024-03-15T00:05:17.938691Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":["<0.6.3"],"fixed":["0.6.3"]}]},{"id":"GHSA-9p9m-9xww-qjcx","url":"https://osv.dev/vulnerability/GHSA-9p9m-9xww-qjcx","summary":"Array size is not checked in sized-chunks","modified":"2024-03-15T00:05:17.938691Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":["<0.6.3"],"fixed":["0.6.3"]}]},{"id":"GHSA-fqpx-cq8x-9wp4","url":"https://osv.dev/vulnerability/GHSA-fqpx-cq8x-9wp4","summary":"Unaligned references in sized-chunks","modified":"2024-03-15T00:05:17.938691Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":["<0.6.3"],"fixed":["0.6.3"]}]},{"id":"GHSA-mp6f-p9gp-vpj9","url":"https://osv.dev/vulnerability/GHSA-mp6f-p9gp-vpj9","summary":"Array size is not checked in sized-chunks","modified":"2024-04-22T18:52:15Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":["<0.6.3"],"fixed":["0.6.3"]}]},{"id":"GHSA-rfgg-vccr-m46m","url":"https://osv.dev/vulnerability/GHSA-rfgg-vccr-m46m","summary":"Missing release of memory in sized-chunks","modified":"2024-03-15T00:05:17.938691Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":["<0.6.3"],"fixed":["0.6.3"]}]},{"id":"GHSA-x54v-qxxr-93qc","url":"https://osv.dev/vulnerability/GHSA-x54v-qxxr-93qc","summary":"Missing release of memory in sized-chunks","modified":"2024-03-15T00:05:17.938691Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":["<0.6.3"],"fixed":["0.6.3"]}]},{"id":"RUSTSEC-2020-0041","url":"https://osv.dev/vulnerability/RUSTSEC-2020-0041","summary":"Multiple soundness issues in Chunk and InlineArray","modified":"2024-03-15T00:05:17.938691Z","packages":[{"ecosystem":"crates.io","name":"sized-chunks","purl":"pkg:cargo/sized-chunks","ranges":[">=0.0.0-0 <0.6.3"],"fixed":["0.6.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}