{"action":"Upgrade bytes to 1.11.1 or later.","affected":[{"fixed":"1.11.1","introduced":"1.2.1"}],"component":"bytes","cve_ids":["CVE-2026-25541"],"ecosystem":"crates.io","epss":0.0061,"exploited":false,"fixed_versions":["1.11.1"],"ghsa_id":"GHSA-434x-w66g-qw3r","id":"tcs_01M5KFAQ3CTBK8VKSS0FS7C5BE","modified_at":"2026-10-12T18:00:09.239418978Z","published_at":"2026-02-03T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0007","https://crates.io/crates/bytes","https://rustsec.org/advisories/RUSTSEC-2026-0007.html","https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0007","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0007"}],"summary":"Integer overflow in `BytesMut::reserve`"}