CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2020-35861
High (7.5) in bumpalo project bumpalo. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in bumpalo 3.2.1.
An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bumpalo_project:bumpalo
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vqx7-pw4r-29rr | crates.io | bumpalo | >=3.0.0 <3.2.1 | 3.2.1 |
| RUSTSEC-2020-0006 | crates.io | bumpalo | >=3.0.0 <3.2.1 | 3.2.1 |