CVE-2026-68510: bit-vec: unsoundness arising with `deserialize` then `get_unchecked`
bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe getunchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.0
Event History
Frequently Asked Questions
Who is affected by this issue?
Applications using bit-vec versions before 0.10.0 may be affected if they deserialize BitVec data from an untrusted source and then perform unsafe get_unchecked operations or other operations on the deserialized BitVec.
What must an attacker be able to do to trigger the issue?
An attacker needs to supply untrusted serialized input that the application deserializes into a BitVec. The application must subsequently run unsafe get_unchecked on that data for the described undefined behavior to occur.
Are applications using only trusted serialized data exposed?
The described condition specifically involves deserialization from an untrusted source. The provided information does not indicate that trusted serialized input alone triggers the issue.
What is the remediation?
Upgrade bit-vec to version 0.10.0, which patches the issue.