CVE-2026-25541

Bytes is vulnerable in versions 1.2.1–before 1.11.1 due to an integer overflow in BytesMut::reserve. In the unique reclaim path, an unchecked addition in the condition v_capacity >= new_cap + offset can cause new_cap + offset to overflow usize in release builds, making self.cap exceed the actu...

Integer overflow in `BytesMut::reserve`

In the unique reclaim path of BytesMut::reserve, the condition rs if vcapacity = newcap + offset uses an unchecked addition. When newcap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacit...