cargo package report

Is smallbitvec safe?

1 known vulnerability, worst severity HIGH.

cvss

7.3

how bad it is if exploited, out of 10

epss

0.20%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-97wc-2hqc-cjgr, the advisory selected below

// advisories

GHSA-97wc-2hqc-cjgr

HIGHCVE-2026-44983

An integer overflow in the internal capacity calculation of smallbitvec can lead to an undersized heap allocation, resulting in a heap buffer overflow through safe APIs only. This allows memory corruption without requiring unsafe code from the caller.

Affected: >=1.0.1, >= 1.0.1, <= 2.6.0
Fixed in: not stated
Weakness: CWE-122
Published: 2026-05-09
Source: osv

NVD MITRE OSV

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so cargo packages are not covered.

Checked 2026-09-22 at 01:37 UTC. The most recent advisory here was published 2026-05-09. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is smallbitvec safe? cargo package security report | CyberXYZ