Undefined Behavior in Bit Vector Library Prior to Version 0.10.0
CVE-2026-68510

6.9MEDIUM

Key Information:

Vendor

Contain-rs

Status
Bit-vec
Vendor
CVE Published:
13 November 2026

What is CVE-2026-68510?

The Bit-Vec library, used for efficient bit manipulation, contains a vulnerability prior to version 0.10.0 that can lead to undefined behavior. This occurs when users deserialize data from untrusted sources and utilize unsafe methods such as get_unchecked. Such practices may result in unexpected outcomes and compromise the integrity of the application. The issue has been addressed with updates in version 0.10.0, ensuring safer operations for users.

Affected Version(s)

bit-vec < 0.10.0

References

https://github.com/contain-rs/bit-vec/security/advisories...
x_refsource_CONFIRM
https://github.com/contain-rs/bit-vec/pull/149
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.