Use of Uninitialized Resource Affecting static-alloc package, versions >=0.2.2 <0.2.6
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-STATICALLOC-10946359
- published25 Jul 2025
- disclosed11 Jul 2025
- creditUnknown
Introduced: 11 Jul 2025
CVE NOT AVAILABLE CWE-908 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade static-alloc to version 0.2.6 or higher.
Overview
static-alloc is a bump allocator on static memory for the alloc-traits crate.
Affected versions of this package are vulnerable to Use of Uninitialized Resource via the MemBump::new function. An attacker can trigger undefined behavior and potentially cause assertion failures or violate internal invariants by invoking allocation methods on the resulting object, which may read uninitialized memory.
Workaround
This vulnerability can be mitigated by calling MemBump::reset immediately after allocation to manually initialize the counter.