CVE-2015-20001

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 1.32%
EPSS Percentile: 71.12%
CISA KEV: Not listed

Description

In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory safety violation.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 12-Apr-2021 03:15
Last Modified: 17-Jun-2026 07:23
EPSS Date: 2026-11-09
CWE: CWE-119

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

CNA Products / Version Status

n/a · n/a Source: CNA · [email protected]
Default status: unknown

n/a — affected

Affected Products / Versions

rust-lang / rust Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 1.2.0
cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*

References

Last enrichment sync: 10-Nov-2026 09:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Rudra looked for both in 2021, and the standard library was already fixing panic safety bugs in 2015 (CVE-2015-20001). Microsoft FORGE Details Rust Standard Library Bugs Found With AI-Assisted Research

CVE (1)

Vendors (1)

Products (2)

Tools (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.