HighFix available
rust — security advisory
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
- Products
- rust
- Affected versions
- Not specified
- Fixed versions
- 1.51.0-r2
- CVEs
- CVE-2020-36323
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 12:11 UTC · Revision 1
Source evidence
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
osv:ALPINE-CVE-2020-36323
rust
Fixed versions: 1.51.0-r2
rust
Fixed versions: 1.51.0-r2
rust
Fixed versions: 1.51.0-r2
rust
Fixed versions: 1.51.0-r2
rust
Fixed versions: 1.51.0-r2
rust
Fixed versions: 1.51.0-r2
Complete source record
{
"id": "8a71fd91875030471434d6e08442fa1f48be0dd951b246ef04e161142015fd1f",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2020-36323",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2020-36323",
"summary": "In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.",
"evidence": "osv:ALPINE-CVE-2020-36323",
"products": [
{
"name": {
"value": "rust",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.51.0-r2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.51.0-r2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.51.0-r2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.51.0-r2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.51.0-r2",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rust",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.51.0-r2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "ALPINE-CVE-2020-36323",
"aliases": [
"ALPINE-CVE-2020-36323"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.51.0-r2"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-36323.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.51.0-r2"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-36323.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.51.0-r2"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-36323.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.51.0-r2"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-36323.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.51.0-r2"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-36323.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.51.0-r2"
}
]
}
],
"package": {
"name": "rust",
"purl": "pkg:apk/alpine/rust?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2020-36323.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-26T11:17:55.175802872Z",
"provider": "osv",
"upstream": [
"CVE-2020-36323"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2020-36323"
]
},
"related_cves": [
{
"value": "CVE-2020-36323",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 450649,
"published_at": "2021-04-14T07:15:12.087+00:00"
}