RUSTSEC-2025-0163 (CVE-2025-47737)

Vulnerability from osv_rustsec – Published: 2025-05-04 12:00 – Updated: 2026-06-10 06:13 – Source website
VLAI
Summary
Unsound issue in Trailer
Details

Our static analyzer find a potential unsound issue in the construction of Trailer, where it doesn't provide enough check to ensure the soundness.

trailer/src/lib.rs, Lines 18 to 25 in d474984:

 pub fn new(capacity: usize) -> Trailer<T> { 
     unsafe { 
         let trailer = Trailer::allocate(capacity); 
         let ptr = trailer.ptr as *mut T; 
         ptr.write(T::default()); 
         trailer 
     } 
 }

The constructor does not check the T is not a ZST in rust, and allocating with size 0 is considered as undefined behaviors in Rust. A poc code like below can work:

use trailer::Trailer;
#[derive(Default)]
struct Zst;

fn main() {
    let mut a = Trailer::<Zst>::new(0);
    drop(a);
}

The trailer crate is unmaintained and this security issue will not be fixed.

Severity
2.9 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "categories": [],
        "cvss": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
        "informational": null
      },
      "ecosystem_specific": {
        "affected_functions": null,
        "affects": {
          "arch": [],
          "functions": [],
          "os": []
        }
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "trailer",
        "purl": "pkg:cargo/trailer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [
    "CVE-2025-47737",
    "GHSA-6x45-r4pr-5362"
  ],
  "database_specific": {
    "license": "CC0-1.0"
  },
  "details": "Our static analyzer find a potential unsound issue\nin the construction of Trailer, where it doesn\u0027t\nprovide enough check to ensure the soundness.\n\ntrailer/src/lib.rs, Lines 18 to 25 in d474984:\n```\n pub fn new(capacity: usize) -\u003e Trailer\u003cT\u003e { \n     unsafe { \n         let trailer = Trailer::allocate(capacity); \n         let ptr = trailer.ptr as *mut T; \n         ptr.write(T::default()); \n         trailer \n     } \n } \n```\n\nThe constructor does not check the T is not a ZST in\nrust, and allocating with size 0 is considered\nas undefined behaviors in Rust. A poc code like\nbelow can work:\n\n```\nuse trailer::Trailer;\n#[derive(Default)]\nstruct Zst;\n\nfn main() {\n    let mut a = Trailer::\u003cZst\u003e::new(0);\n    drop(a);\n}\n```\n\nThe trailer crate is unmaintained and this security issue\nwill not be fixed.",
  "id": "RUSTSEC-2025-0163",
  "modified": "2026-06-10T06:13:29Z",
  "published": "2025-05-04T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://crates.io/crates/trailer"
    },
    {
      "type": "ADVISORY",
      "url": "https://rustsec.org/advisories/RUSTSEC-2025-0163.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/Geal/trailer/issues/2"
    }
  ],
  "related": [],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unsound issue in Trailer"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.