CVE-2021-28877

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-11 · updated 2026-06-17
Weakness: CWE-119

Description

In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait.

Affected products

rust-lang rust: before 1.51.0 — fixed in 1.51.0

How to fix

Upgrade to a fixed version: rust-lang rust 1.51.0. Check the vendor advisory for mitigations.

References

https://github.com/rust-lang/rust/pull/80670
https://security.gentoo.org/glsa/202210-09
https://github.com/rust-lang/rust/pull/80670
https://security.gentoo.org/glsa/202210-09

Get alerted when CVE-2021-28877 or the next vulnerability affects your stack