Threat database

CVE-2026-25541 is a medium severity integer overflow vulnerability in the tokio-rs bytes library affecting versions 1.2.1 through 1.11.0. The issue arises in the BytesMut::reserve function where unchecked addition can overflow the usize type in release builds, corrupting the capacity value. This can lead to out-of-bounds slices and undefined behavior, potentially causing memory corruption or crashes. No authentication or user interaction is required to trigger the vulnerability. It has been patched in version 1.11.