What’s Vulnerable › Vulnerabilities

CVE-2020-35861

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-31 · updated 2026-06-17
• Weakness: CWE-125

Description

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

Affected products

• Bumpalo Project Bumpalo: from 3.0.0 before 3.2.1 — fixed in 3.2.1

How to fix

Upgrade to a fixed version: Bumpalo Project Bumpalo 3.2.1. Check the vendor advisory for mitigations.

References

• https://rustsec.org/advisories/RUSTSEC-2020-0006.html
• https://rustsec.org/advisories/RUSTSEC-2020-0006.html

Get alerted when CVE-2020-35861 or the next vulnerability affects your stack