[renovate]

This PR contains the following updates:

Package	Type	Update	Change
bytes	workspace.dependencies	minor	=1.10.1 → =1.11.1
bytes	dependencies	minor	1.4.0 → 1.11.1

---

bytes has integer overflow in BytesMut::reserve

CVE-2026-25541 / GHSA-434x-w66g-qw3r

More information

Details

Details

In the unique reclaim path of BytesMut::reserve, the condition

if v_capacity >= new_cap + offset

uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

PoC

use bytes::*;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);

    // Ensure b becomes the unique owner of the backing storage
    drop(a);

    // Trigger overflow in new_cap + offset inside reserve
    b.reserve(usize::MAX - 6);

    // This call relies on the corrupted cap and may cause UB & HBO
    b.put_u8(b'h');
}

Workarounds

Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.

This vulnerability is also known as RUSTSEC-2026-0007.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r
• https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f
• https://github.com/tokio-rs/bytes/releases/tag/v1.11.1
• https://rustsec.org/advisories/RUSTSEC-2026-0007.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-25541
• https://github.com/advisories/GHSA-434x-w66g-qw3r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tokio-rs/bytes (bytes)

v1.11.1

Compare Source

• Fix integer overflow in BytesMut::reserve

v1.11.0

Compare Source

• Bump MSRV to 1.57 (#​788)

Fixed

• fix: BytesMut only reuse if src has remaining (#​803)
• Specialize BytesMut::put::<Bytes> (#​793)
• Reserve capacity in BytesMut::put (#​794)
• Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#​795)

Internal changes

• Guarantee address in slice() for empty slices. (#​780)
• Rename Vtable::to_* -> Vtable::into_* (#​776)
• Fix latest clippy warnings (#​787)
• Ignore BytesMut::freeze doctest on wasm (#​790)
• Move drop_fn of from_owner into vtable (#​801)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e94726d2-df93-46d9-ab07-a4b35931599f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 834cb49f-0f71-47bd-a03d-9f0bf41728a1

📥 Commits

Reviewing files that changed from the base of the PR and between fcb1c98 and 87555c4.

⛔ Files ignored due to path filters (2)

• pkgs/pavex/libs/Cargo.lock is excluded by !**/*.lock
• pkgs/roc/platforms/rust-minimal-cli/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pkgs/roc/platforms/rust-minimal-cli/Cargo.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The Rust minimal CLI manifest updates the bytes dependency version from 1.10.1 to 1.11.1.

Changes: Rust minimal CLI dependency

Layer / File(s)	Summary
Update bytes version pkgs/roc/platforms/rust-minimal-cli/Cargo.toml	The manifest changes the bytes dependency version from 1.10.1 to 1.11.1.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 87555

The Rust minimal CLI now resolves bytes 1.11.1, and its lockfile matches that version. No actionable merge-blocking issue is evident in the supplied change; routine build and test validation remains appropriate.

Architecture risk: 🔵 Low · up to 87555

The change affects 1 system.

Changed systems: pkgs

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — pkgs (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in pkgs/roc/platforms/rust-minimal-cli/Cargo.toml: The bytes dependency version changes from 1.10.1 to 1.11.1.

Pre-merge checks: 5

Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating the Rust bytes crate to version 1.11.1 for a security fix.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}