HighFix available
rustc — security advisory
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
- Products
- rustc
- Affected versions
- Not specified
- Fixed versions
- 1.53.0+dfsg1-1
- CVEs
- CVE-2020-36323
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 14:01 UTC · Revision 1
Source evidence
In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.
osv:DEBIAN-CVE-2020-36323
rustc
Fixed versions: 1.53.0+dfsg1-1
rustc
Fixed versions: 1.53.0+dfsg1-1
rustc
Fixed versions: 1.53.0+dfsg1-1
Complete source record
{
"id": "a18830e0f391da46bab9b4278005627f467ee97de26f081881dee36710f1a31a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-36323",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-36323",
"summary": "In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.",
"evidence": "osv:DEBIAN-CVE-2020-36323",
"products": [
{
"name": {
"value": "rustc",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.53.0+dfsg1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rustc",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.53.0+dfsg1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "rustc",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.53.0+dfsg1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2020-36323",
"aliases": [
"DEBIAN-CVE-2020-36323"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.53.0+dfsg1-1"
}
]
}
],
"package": {
"name": "rustc",
"purl": "pkg:deb/debian/rustc?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-36323.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.53.0+dfsg1-1"
}
]
}
],
"package": {
"name": "rustc",
"purl": "pkg:deb/debian/rustc?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-36323.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.53.0+dfsg1-1"
}
]
}
],
"package": {
"name": "rustc",
"purl": "pkg:deb/debian/rustc?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-36323.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:02:49.208253604Z",
"provider": "osv",
"upstream": [
"CVE-2020-36323"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-36323"
]
},
"related_cves": [
{
"value": "CVE-2020-36323",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 453065,
"published_at": "2021-04-14T07:15:12.087+00:00"
}