What is the CVSS score of CVE-2026-25541?

CVE-2026-25541 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bytes are affected by CVE-2026-25541?

CVE-2026-25541 is a high-severity integer overflow vulnerability in the Bytes library (versions 1.2.1-1.11.0) that could allow attackers to cause denial of service or potentially execute arbitrary…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25541?

Yes, a public proof-of-concept exploit is available for CVE-2026-25541. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25541?

Within 24 hours: Identify all internal and third-party applications using Bytes library versions 1.2.1 through 1.11.0 via dependency scanning tools and software bill of materials (SBOM) review. Within 7 days: Apply vendor patch to upgrade Bytes to version 1.11.1 or later across all affected systems, prioritizing production and customer-facing applications. Within 30 days: Conduct full regression testing of patched systems, update dependency management policies to enforce minimum Bytes version 1.11.1+, and implement automated vulnerability scanning in CI/CD pipelines to prevent future vulnerable dependency introduction.

Bytes CVE-2026-25541

HIGH

Integer Overflow to Buffer Overflow (CWE-680)

2026-02-04 security-advisories@github.com

GHSA-434x-w66g-qw3r

Integer Overflow Bytes

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 27, 2026 - 20:13 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 20:13 nvd

Patch available

CVE Published

Feb 04, 2026 - 22:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

51 cargo packages depend on bytes (7 direct, 45 indirect)

Ecosystem-wide dependent count for version 1.2.1.

DescriptionGitHub Advisory

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB. This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks. This issue has been patched in version 1.11.1.

AnalysisAI

Integer overflow in the Bytes library versions 1.2.1 through 1.11.0 allows attackers to corrupt the BytesMut capacity value, leading to out-of-bounds memory access and undefined behavior in release builds. Public exploit code exists for this vulnerability, affecting applications that depend on Bytes for buffer management. A patch is available in version 1.11.1.

Technical ContextAI

Affects Bytes. Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() th