Servo vulnerabilities
7 vulnerabilities
Known vulnerabilities in Servo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Smallvec5 vulnerabilities
- Idna1 vulnerabilities
- Rust Url1 vulnerabilities
- Smallbitvec1 vulnerabilities
CVE-2018-20991Crates.Iosmallvec+3
EPSS score1.85%
An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.CVE-2018-25023Crates.Iosmallvec+3EPSS score1.42%
An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.CVE-2021-25900Crates.Iosmallvec+7EPSS score1.72%
An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.CVE-2024-12224chainguardatuin+146EPSS score0.22%
Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.CVE-2019-15554Crates.Iosmallvec+2EPSS score2.14%
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.CVE-2019-15551Crates.Iosmallvec+2EPSS score1.86%
An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capacity.CVE-2026-44983Crates.Iosmallbitvec+3EPSS score0.16%
smallbitvec is a growable bit-vector for Rust, optimized for size. From 1.0.1 to 2.6.0, an integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller. This vulnerability is fixed in 2.6.1.