CVE-2025-55159: tokio-rs slab

Vulnerability summary

CVE-2025-55159 is a medium (CVSS 5.1) vulnerability in tokio-rs slab. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.5% of scored vulnerabilities.

Timeline

1. 11-08-2025
   PublishedVulnerability first disclosed.
2. 12-08-2025
   Last modifiedVulnerability information updated.

Description

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.