---
id: CVE-2026-25541
aliases:
  - RUSTSEC-2026-0007
  - GHSA-434x-w66g-qw3r
title: 'Integer overflow in `BytesMut::reserve`'
summary: 'Integer overflow in `BytesMut::reserve`'
severity: none
vendor: bytes
product: bytes
ecosystem: rust
affected:
  - 'bytes >= 1.2.1, < 1.11.1'
patched:
  - bytes 1.11.1
published: '2026-02-03'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:09.239418978Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0007'
references:
  - url: 'https://crates.io/crates/bytes'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0007.html'
  - url: >-
      https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f
tags:
  - osv
  - rust
  - exploit-available
epss: 0.0061
epssPercentile: 0.47735
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/trajanOx/cve-2026-25541-fuel-analysis'
  checkedAt: '2026-10-13T11:46:04.385Z'
exploitAvailable: true
ingestedAt: '2026-10-13T11:45:30.183Z'
---

## Overview

In the unique reclaim path of `BytesMut::reserve`, the condition
```rs
if v_capacity >= new_cap + offset
```
uses an unchecked addition. When `new_cap + offset` overflows `usize` in release builds, this condition may incorrectly pass, causing `self.cap` to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as `spare_capacity_mut()` then trust this corrupted `cap` value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

## PoC

```rs
use bytes::*;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);

    // Ensure b becomes the unique owner of the backing storage
    drop(a);

    // Trigger overflow in new_cap + offset inside reserve
    b.reserve(usize::MAX - 6);

    // This call relies on the corrupted cap and may cause UB & HBO
    b.put_u8(b'h');
}
```

# Workarounds

Users of `BytesMut::reserve` are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.

## Affected packages

- `bytes >= 1.2.1, < 1.11.1`

## Remediation

Upgrade to a patched release:

- `bytes 1.11.1`