{"action":"Upgrade bytes to 1.11.1 or later.","affected":[{"fixed":"1.11.1","introduced":"1.2.1"}],"component":"bytes","cve_ids":["CVE-2026-25541"],"ecosystem":"crates.io","epss":0.00601,"exploited":false,"fixed_versions":["1.11.1"],"ghsa_id":"GHSA-434x-w66g-qw3r","id":"tcs_01M5KES6TXEBVJJ85YE5RBN6Z7","modified_at":"2026-09-10T03:50:33.995841351Z","published_at":"2026-02-03T19:17:46Z","references":["https://osv.dev/vulnerability/GHSA-434x-w66g-qw3r","https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r","https://nvd.nist.gov/vuln/detail/CVE-2026-25541","https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f","https://github.com/tokio-rs/bytes","https://github.com/tokio-rs/bytes/releases/tag/v1.11.1","https://rustsec.org/advisories/RUSTSEC-2026-0007.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-434x-w66g-qw3r","url":"https://osv.dev/vulnerability/GHSA-434x-w66g-qw3r"},{"source":"nvd","source_id":"CVE-2026-25541","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25541"}],"summary":"bytes has integer overflow in BytesMut::reserve"}