CVE catalog

CVE-2025-55159

rust-slab: CVE-2025-55159

[CVE catalog]

Severity
Medium · CVSS 5.8CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 23, 2026

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-slabsid0.4.12-1not affected
Debianrust-slabforky0.4.12-1not affected
Debianrust-slabtrixie0.4.9-1not affected
Debianrust-slabbookworm0.4.4-1not affected
Opensusegit-cliffleap 16.02.13.1-bp160.1.1fixed
Opensuseafterburntumbleweed5.10.0.git73.b97f772-2.1fixed
Suseglycin-loaderslinux enterprise server 16.01.2.1-160000.3.1fixed
Suseglycin-loaderslinux enterprise server for sap applications 16.01.2.1-160000.3.1fixed
Opensuseglycin-loadersleap 16.01.2.1-160000.3.1fixed
Opensusegit-clifftumbleweed2.12.0-1.1fixed
Suserust-keylimelinux micro 6.20.2.8+116-160000.1.1fixed
Opensuserust-keylimeleap 16.00.2.8+116-160000.1.1fixed
Opensusegstreamerleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-devtoolsleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-docsleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-plugins-badleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-plugins-baseleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-plugins-goodleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-plugins-libavleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-plugins-rsleap 16.01.26.7+git0.6ab75814-160000.1.1fixed
Opensusegstreamer-plugins-uglyleap 16.01.26.7-160000.1.1fixed
Opensusegstreamer-rtsp-serverleap 16.01.26.7-160000.1.1fixed
Opensuseflake-pilotleap 16.03.1.22-160000.1.1fixed
Opensusewatchexectumbleweed2.3.2-2.1fixed
Opensusescxtumbleweed1.0.15-2.1fixed
Opensusefractaltumbleweed12.0-3.1fixed
Opensuserust-keylimetumbleweed0.2.8+12-1.1fixed
Opensuseflake-pilottumbleweed3.1.21-1.1fixed
Opensusewicked2nmtumbleweed1.2.1-1.1fixed
Opensuseaws-efs-utilstumbleweed2.3.3-1.1fixed
Opensusegstreamer-plugins-rstumbleweed1.26.5+git11.949807a4-1.1fixed
Opensuseframework_tooltumbleweed0.4.5-2.1fixed
Opensusegstreamer-devtoolstumbleweed1.26.5-1.1fixed
Susegstreamerlinux micro 6.21.26.7-160000.1.1fixed
Susegstreamer-plugins-baselinux micro 6.21.26.7-160000.1.1fixed
Susesccachelinux enterprise module for development tools 15 sp60.4.2~4-150600.10.6.1fixed
Susesccachelinux enterprise module for development tools 15 sp70.4.2~4-150600.10.6.1fixed
Opensusesccacheleap 15.60.4.2~4-150600.10.6.1fixed
Suseflake-pilotlinux enterprise server 16.03.1.22-160000.1.1fixed
Suseflake-pilotlinux enterprise server for sap applications 16.03.1.22-160000.1.1fixed
Suserust-keylimelinux enterprise micro 5.50.2.8+12-150500.3.8.1fixed
Suserust-keylimelinux enterprise micro 5.40.2.8+12-150400.3.8.1fixed
Suserust-keylimelinux enterprise micro 5.30.2.8+12-150400.3.10.1fixed
Suseaws-efs-utilslinux enterprise module for public cloud 15 sp62.3.3-150600.17.6.1fixed
Suseaws-efs-utilslinux enterprise module for public cloud 15 sp72.3.3-150600.17.6.1fixed
Opensuseaws-efs-utilsleap 15.62.3.3-150600.17.6.1fixed
SuseSLES16-Migrationlinux enterprise module for basesystem 15 sp72.1.26-15.22.4fixed
Susepython-Cerberuslinux enterprise module for basesystem 15 sp71.3.2-150700.20.2.10fixed
Susesuse-migration-serviceslinux enterprise module for basesystem 15 sp72.1.26-150700.16.12.1fixed
Susesuse-migration-sle16-activationlinux enterprise module for basesystem 15 sp72.1.26-150700.15.9.1fixed
Susewicked2nmlinux enterprise module for basesystem 15 sp71.4.0-150700.15.7.2fixed
SuseSLES16-SAP_Migrationlinux enterprise module for sap applications 15 sp72.1.26-15.14.4fixed
Opensuseab-av1tumbleweed0.11.7-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-slabsourcesidNot affectedunimportantNot reportedNot reported
Debianrust-slabsourceforkyNot affectedunimportantNot reportedNot reported
Debianrust-slabsourcetrixieNot affectedunimportantNot reportedNot reported
Debianrust-slabsourcebookwormNot affectedunimportantNot reportedNot reported
Opensusegit-cliffrpmleap 16.02.13.1-bp160.1.1Not reportedOPENSUSE-SU-2026:21584-1Not reported
Opensuseafterburnrpmtumbleweed5.10.0.git73.b97f772-2.1Not reportedOPENSUSE-SU-2026:11324-1Not reported
Suseglycin-loadersrpmlinux enterprise server 16.01.2.1-160000.3.1Not reportedSUSE-SU-2026:22302-1Not reported
Suseglycin-loadersrpmlinux enterprise server for sap applications 16.01.2.1-160000.3.1Not reportedSUSE-SU-2026:22302-1Not reported
Opensuseglycin-loadersrpmleap 16.01.2.1-160000.3.1Not reportedOPENSUSE-SU-2026:21134-1Not reported
Opensusegit-cliffrpmtumbleweed2.12.0-1.1Not reportedOPENSUSE-SU-2026:10496-1Not reported
Suserust-keylimerpmlinux micro 6.20.2.8+116-160000.1.1Not reportedSUSE-SU-2026:20744-1Not reported
Opensuserust-keylimerpmleap 16.00.2.8+116-160000.1.1Not reportedOPENSUSE-SU-2026:20364-1Not reported
Opensusegstreamerrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-devtoolsrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-docsrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-plugins-badrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-plugins-baserpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-plugins-goodrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-plugins-libavrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-plugins-rsrpmleap 16.01.26.7+git0.6ab75814-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-plugins-uglyrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensusegstreamer-rtsp-serverrpmleap 16.01.26.7-160000.1.1Not reportedOPENSUSE-SU-2026:20329-1Not reported
Opensuseflake-pilotrpmleap 16.03.1.22-160000.1.1Not reportedOPENSUSE-SU-2025:20013-1Not reported
Opensusewatchexecrpmtumbleweed2.3.2-2.1Not reportedOPENSUSE-SU-2025:15554-1Not reported
Opensusescxrpmtumbleweed1.0.15-2.1Not reportedOPENSUSE-SU-2025:15497-1Not reported
Opensusefractalrpmtumbleweed12.0-3.1Not reportedOPENSUSE-SU-2025:15492-1Not reported
Opensuserust-keylimerpmtumbleweed0.2.8+12-1.1Not reportedOPENSUSE-SU-2025:15480-1Not reported
Opensuseflake-pilotrpmtumbleweed3.1.21-1.1Not reportedOPENSUSE-SU-2025:15475-1Not reported
Opensusewicked2nmrpmtumbleweed1.2.1-1.1Not reportedOPENSUSE-SU-2025:15470-1Not reported
Opensuseaws-efs-utilsrpmtumbleweed2.3.3-1.1Not reportedOPENSUSE-SU-2025:15461-1Not reported
Opensusegstreamer-plugins-rsrpmtumbleweed1.26.5+git11.949807a4-1.1Not reportedOPENSUSE-SU-2025:15446-1Not reported
Opensuseframework_toolrpmtumbleweed0.4.5-2.1Not reportedOPENSUSE-SU-2025:15444-1Not reported
Opensusegstreamer-devtoolsrpmtumbleweed1.26.5-1.1Not reportedOPENSUSE-SU-2025:15445-1Not reported
Susegstreamerrpmlinux micro 6.21.26.7-160000.1.1Not reportedSUSE-SU-2026:20686-1Not reported
Susegstreamer-plugins-baserpmlinux micro 6.21.26.7-160000.1.1Not reportedSUSE-SU-2026:20686-1Not reported
Susesccacherpmlinux enterprise module for development tools 15 sp60.4.2~4-150600.10.6.1Not reportedSUSE-SU-2025:3944-1Not reported
Susesccacherpmlinux enterprise module for development tools 15 sp70.4.2~4-150600.10.6.1Not reportedSUSE-SU-2025:3944-1Not reported
Opensusesccacherpmleap 15.60.4.2~4-150600.10.6.1Not reportedSUSE-SU-2025:3944-1Not reported
Suseflake-pilotrpmlinux enterprise server 16.03.1.22-160000.1.1Not reportedSUSE-SU-2025:20921-1Not reported
Suseflake-pilotrpmlinux enterprise server for sap applications 16.03.1.22-160000.1.1Not reportedSUSE-SU-2025:20921-1Not reported
Suserust-keylimerpmlinux enterprise micro 5.50.2.8+12-150500.3.8.1Not reportedSUSE-SU-2025:02962-1Not reported
Suserust-keylimerpmlinux enterprise micro 5.40.2.8+12-150400.3.8.1Not reportedSUSE-SU-2025:02961-1Not reported
Suserust-keylimerpmlinux enterprise micro 5.30.2.8+12-150400.3.10.1Not reportedSUSE-SU-2025:02957-1Not reported
Suseaws-efs-utilsrpmlinux enterprise module for public cloud 15 sp62.3.3-150600.17.6.1Not reportedSUSE-SU-2025:3954-1Not reported
Suseaws-efs-utilsrpmlinux enterprise module for public cloud 15 sp72.3.3-150600.17.6.1Not reportedSUSE-SU-2025:3954-1Not reported
Opensuseaws-efs-utilsrpmleap 15.62.3.3-150600.17.6.1Not reportedSUSE-SU-2025:3954-1Not reported
SuseSLES16-Migrationrpmlinux enterprise module for basesystem 15 sp72.1.26-15.22.4Not reportedSUSE-RU-2025:4131-1Not reported
Susepython-Cerberusrpmlinux enterprise module for basesystem 15 sp71.3.2-150700.20.2.10Not reportedSUSE-RU-2025:4131-1Not reported
Susesuse-migration-servicesrpmlinux enterprise module for basesystem 15 sp72.1.26-150700.16.12.1Not reportedSUSE-RU-2025:4131-1Not reported
Susesuse-migration-sle16-activationrpmlinux enterprise module for basesystem 15 sp72.1.26-150700.15.9.1Not reportedSUSE-RU-2025:4131-1Not reported
Susewicked2nmrpmlinux enterprise module for basesystem 15 sp71.4.0-150700.15.7.2Not reportedSUSE-RU-2025:4131-1Not reported
SuseSLES16-SAP_Migrationrpmlinux enterprise module for sap applications 15 sp72.1.26-15.14.4Not reportedSUSE-RU-2025:4131-1Not reported
Opensuseab-av1rpmtumbleweed0.11.7-1.1Not reportedOPENSUSE-SU-2026:12171-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ab-av1]Affected

    Source package: [ab-av1]

    Details (1)

    • 0.11.0-1.4 · x86_64 · tumbleweed

      Affected · Fixed: 0.11.7-1.1

      dsa · ab-av1 · opensuse · tumbleweed

  • [afterburn-dracut]Unknown

    Source package: [afterburn]

    Details (1)

    • 5.10.0.git73.b97f772-2.1 · noarch · tumbleweed

      Unknown · Fixed: 5.10.0.git73.b97f772-2.1

      Version impact unknown

      dsa · afterburn · opensuse · tumbleweed

  • [flake-pilot-firecracker]Unknown

    Source package: [flake-pilot]

    Details (1)

    • 3.1.45-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.21-1.1

      Version impact unknown

      dsa · flake-pilot · opensuse · tumbleweed

  • [flake-pilot-firecracker-dracut-netstart]Unknown

    Source package: [flake-pilot]

    Details (1)

    • 3.1.45-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.1.21-1.1

      Version impact unknown

      dsa · flake-pilot · opensuse · tumbleweed

  • [flake-pilot-firecracker-guestvm-tools]Unknown

    Source package: [flake-pilot]

    Details (1)

    • 3.1.45-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.21-1.1

      Version impact unknown

      dsa · flake-pilot · opensuse · tumbleweed

  • [flake-pilot-podman]Unknown

    Source package: [flake-pilot]

    Details (1)

    • 3.1.45-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.1.21-1.1

      Version impact unknown

      dsa · flake-pilot · opensuse · tumbleweed

  • [fractal-lang]Unknown

    Source package: [fractal]

    Details (1)

    • 14.1-1.2 · noarch · tumbleweed

      Unknown · Fixed: 12.0-3.1

      Version impact unknown

      dsa · fractal · opensuse · tumbleweed

  • [git-cliff-bash-completion]Unknown

    Source package: [git-cliff]

    Details (1)

    • 2.13.1-2.1 · noarch · tumbleweed

      Unknown · Fixed: 2.12.0-1.1

      Version impact unknown

      dsa · git-cliff · opensuse · tumbleweed

  • [git-cliff-fish-completion]Unknown

    Source package: [git-cliff]

    Details (1)

    • 2.13.1-2.1 · noarch · tumbleweed

      Unknown · Fixed: 2.12.0-1.1

      Version impact unknown

      dsa · git-cliff · opensuse · tumbleweed

  • [git-cliff-zsh-completion]Unknown

    Source package: [git-cliff]

    Details (1)

    • 2.13.1-2.1 · noarch · tumbleweed

      Unknown · Fixed: 2.12.0-1.1

      Version impact unknown

      dsa · git-cliff · opensuse · tumbleweed

  • [gstreamer-devtools-devel]Unknown

    Source package: [gstreamer-devtools]

    Details (1)

    • 1.28.6-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.26.5-1.1

      Version impact unknown

      dsa · gstreamer-devtools · opensuse · tumbleweed

  • [keylime-ima-policy]Unknown

    Source package: [rust-keylime]

    Details (1)

    • 0.2.9+49-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 0.2.8+12-1.1

      Version impact unknown

      dsa · rust-keylime · opensuse · tumbleweed

  • [libgstvalidate-1_0-0]Unknown

    Source package: [gstreamer-devtools]

    Details (1)

    • 1.28.6-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.26.5-1.1

      Version impact unknown

      dsa · gstreamer-devtools · opensuse · tumbleweed

  • [scx-devel]Unknown

    Source package: [scx]

    Details (1)

    • 1.1.1-2.3 · noarch · tumbleweed

      Unknown · Fixed: 1.0.15-2.1

      Version impact unknown

      dsa · scx · opensuse · tumbleweed

  • [typelib-1_0-GstValidate-1_0]Unknown

    Source package: [gstreamer-devtools]

    Details (1)

    • 1.28.6-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.26.5-1.1

      Version impact unknown

      dsa · gstreamer-devtools · opensuse · tumbleweed

  • [afterburn]Fixed

    Source package: [afterburn]

    Details (1)

    • 5.10.0.git73.b97f772-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.10.0.git73.b97f772-2.1

      dsa · afterburn · opensuse · tumbleweed

  • [aws-efs-utils]Fixed

    Source package: [aws-efs-utils]

    Details (1)

    • 3.2.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 2.3.3-1.1

      dsa · aws-efs-utils · opensuse · tumbleweed

  • [flake-pilot]Fixed

    Source package: [flake-pilot]

    Details (1)

    • 3.1.45-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 3.1.21-1.1

      dsa · flake-pilot · opensuse · tumbleweed

  • [fractal]Fixed

    Source package: [fractal]

    Details (1)

    • 14.1-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 12.0-3.1

      dsa · fractal · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [librust-slab-dev]Not affected

    Source package: [rust-slab]

    Details (2)

    • 0.4.4-1+b1 · amd64 · bookworm

      Not affected

      dsa · rust-slab · debian · bookworm

    • 0.4.4-1+b1 · arm64 · bookworm

      Not affected

      dsa · rust-slab · debian · bookworm

Next results

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]