slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tokio-rs | slab | 0.4.10 to before 0.4.11 | 0.4.11 | Patch available | CNA |
| — | slab (crates.io) | 0.4.10 to before 0.4.11 | 0.4.11 | Patch available | GHSA-qx2v-8332-m4fv |
- slab Vendortokio-rs Affected 0.4.10 to before 0.4.11 Fixed in 0.4.11 Patch available CNA
- slab (crates.io) Vendor— Affected 0.4.10 to before 0.4.11 Fixed in 0.4.11 Patch available GHSA-qx2v-8332-m4fv
Remediation
- Fix · CNA slab (tokio-rs) Fixed in 0.4.11
- Fix · GHSA-qx2v-8332-m4fv slab (crates.io) Fixed in 0.4.11 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
Not affected: 14 products
- Confidential Compute Attestation
- Logging Subsystem for Red Hat OpenShift
- OpenShift Serverless
- OpenShift Service Mesh 3
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer
- Red Hat Trusted Profile Analyzer
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55159
- 2026-10-03 Alias added: GHSA-qx2v-8332-m4fv
References
More tokio-rs vulnerabilities
- TI-2024-18146 Mio's tokens for named pipes may be delivered after deregistration CVSS 3.1CRITICAL 9.1
- TI-2026-20650 Bytes is vulnerable to integer overflow in BytesMut::reserve CVSS 4.0MEDIUM 5.5
- TI-2022-02967 DoS in axum-core due to missing request size limit CVSS 3.1HIGH 7.5
- TI-2026-79968 Race condition in Tokio time Interval can cause use-after-free CVSS 4.0MEDIUM 5.8
- TI-2023-08715 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe CVSS 3.1MEDIUM 5.4
- TI-2025-35976 Tracing logging user input may result in poisoning logs with ANSI escape sequences CVSS 4.0LOW 2.3
Sources
- CVE-2025-55159 · CVE Program
- CVE-2025-55159 · NVD
- FIRST EPSS
- GHSA-qx2v-8332-m4fv · GitHub Advisory Database · CC BY 4.0
- CVE-2025-55159 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences