Bytes, a Rust byte handling library, has an integer overflow flaw in its BytesMut::reserve function. The overflow occurs when the code adds the desired capacity and an offset together without bounds checking. In release builds this can wrap, allowing the condition that validates the new capacity to succeed incorrectly. As a result, the internal buffer length is set beyond the actual allocation. Subsequent operations that trust this corrupted value can create slices that read or write past the allocated memory, causing undefined behavior and potential memory corruption.

The vulnerability affects tokio-rs/bytes library versions 1.2.1 through 1.11.0. All applications that compile against these versions are impacted; the fix was applied in release 1.11.1.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% implies a low likelihood of exploitation today. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply input that triggers the reserve method with a large offset, which is typically only possible within an application that adopts the unsafe path. The flaw manifests only in release builds; debug builds trigger a panic, so realistic exploitation is harder. Based on the description, it is inferred that the attack vector involves providing crafted input to the reserve method, but the specific details are not explicitly documented.