CVE catalog

CVE-2021-25900

rust-smallvec: CVE-2021-25900

Severity: High · CVSS 7.4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jan 26, 2021, 6:16:22 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.72% · Oct 22, 2026

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	rust-smallvec	sid	`1.16.2-1`	fixed
Debian	rust-smallvec	forky	`1.15.2-1`	fixed
Debian	rust-smallvec	trixie	`1.13.2-1`	fixed
Debian	rust-smallvec	bookworm	`1.9.0-1`	fixed
Opensuse	librsvg	leap 15.2	`2.46.5-lp152.2.3.1`	fixed
Suse	librsvg	linux enterprise module for basesystem 15 sp2	`2.46.5-3.3.1`	fixed
Suse	librsvg	linux enterprise module for desktop applications 15 sp2	`2.46.5-3.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	rust-smallvec	source	sid	`1.4.2-2`	not yet assigned	Not reported	[984665]
Debian	rust-smallvec	source	forky	`1.4.2-2`	not yet assigned	Not reported	[984665]
Debian	rust-smallvec	source	trixie	`1.4.2-2`	not yet assigned	Not reported	[984665]
Debian	rust-smallvec	source	bookworm	`1.4.2-2`	not yet assigned	Not reported	[984665]
Opensuse	librsvg	rpm	leap 15.2	`2.46.5-lp152.2.3.1`	Not reported	OPENSUSE-SU-2021:0634-1	Not reported
Suse	librsvg	rpm	linux enterprise module for basesystem 15 sp2	`2.46.5-3.3.1`	Not reported	SUSE-SU-2021:1408-1	Not reported
Suse	librsvg	rpm	linux enterprise module for desktop applications 15 sp2	`2.46.5-3.3.1`	Not reported	SUSE-SU-2021:1408-1	Not reported

[Debian bug #984665]

OpenFactory catalog packages

Vulnerability data is temporarily unavailable.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]