Update Rust crate bytes to v1.11.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
bytes	dependencies	minor	1.5.0 → 1.11.1

---

bytes has integer overflow in BytesMut::reserve

CVE-2026-25541 / GHSA-434x-w66g-qw3r

More information

Details

Details

In the unique reclaim path of BytesMut::reserve, the condition

if v_capacity >= new_cap + offset

uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

PoC

use bytes::*;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);

    // Ensure b becomes the unique owner of the backing storage
    drop(a);

    // Trigger overflow in new_cap + offset inside reserve
    b.reserve(usize::MAX - 6);

    // This call relies on the corrupted cap and may cause UB & HBO
    b.put_u8(b'h');
}

Workarounds

Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.

This vulnerability is also known as RUSTSEC-2026-0007.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r
• https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f
• https://github.com/tokio-rs/bytes/releases/tag/v1.11.1
• https://rustsec.org/advisories/RUSTSEC-2026-0007.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-25541
• https://github.com/advisories/GHSA-434x-w66g-qw3r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tokio-rs/bytes (bytes)

v1.11.1

Compare Source

• Fix integer overflow in BytesMut::reserve

v1.11.0

Compare Source

• Bump MSRV to 1.57 (#​788)

Fixed

• fix: BytesMut only reuse if src has remaining (#​803)
• Specialize BytesMut::put::<Bytes> (#​793)
• Reserve capacity in BytesMut::put (#​794)
• Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#​795)

Internal changes

• Guarantee address in slice() for empty slices. (#​780)
• Rename Vtable::to_* -> Vtable::into_* (#​776)
• Fix latest clippy warnings (#​787)
• Ignore BytesMut::freeze doctest on wasm (#​790)
• Move drop_fn of from_owner into vtable (#​801)

v1.10.1

Compare Source

Fixed

• Fix memory leak when using to_vec with Bytes::from_owner (#​773)

v1.10.0

Compare Source

Added

• Add feature to support platforms without atomic CAS (#​467)
• try_get_* methods for Buf trait (#​753)
• Implement Buf::chunks_vectored for Take (#​617)
• Implement Buf::chunks_vectored for VecDeque<u8> (#​708)

Fixed

• Remove incorrect guarantee for chunks_vectored (#​754)
• Ensure that tests pass under panic=abort (#​749)

v1.9.0

Compare Source

Added

• Add Bytes::from_owner to enable externally-allocated memory (#​742)

Documented

• Fix typo in Buf::chunk() comment (#​744)

Internal changes

• Replace BufMut::put with BufMut::put_slice in Writer impl (#​745)
• Rename hex_impl! to fmt_impl! and reuse it for fmt::Debug (#​743)

v1.8.0

Compare Source

• Guarantee address in split_off/split_to for empty slices (#​740)

v1.7.2

Compare Source

Fixed

• Fix default impl of Buf::{get_int, get_int_le} (#​732)

Documented

• Fix double spaces in comments and doc comments (#​731)

Internal changes

• Ensure BytesMut::advance reduces capacity (#​728)

v1.7.1

Compare Source

This release reverts the following change due to a regression:

• Reuse capacity when possible in <BytesMut as Buf>::advance impl (#​698)

The revert can be found at #​726.

v1.7.0

Compare Source

Added

• Add conversion from Bytes to BytesMut (#​695, #​710)
• Add reclaim method without additional allocation (#​686)

Documented

• Clarify how BytesMut::zeroed works (#​714)
• Clarify the behavior of Buf::chunk (#​717)

Changed

• Change length condition of BytesMut::truncate
• Reuse capacity when possible in <BytesMut as Buf>::advance impl (#​698)
• Improve must_use suggestion of BytesMut::split (#​699)

Internal changes

• Use ManuallyDrop instead of mem::forget (#​678)
• Don't set len in BytesMut::reserve (#​682)
• Optimize Bytes::copy_to_bytes (#​688)
• Refactor BytesMut::truncate (#​694)
• Refactor BytesMut::resize (#​696)
• Reorder assertion in Bytes::split_to, Bytes::split_off (#​689, #​693)
• Use offset_from in more places (#​705)
• Correct the wrong usage of IntoIter (#​707)

v1.6.1

Compare Source

This release fixes a bug where Bytes::is_unique returns incorrect values when
the Bytes originates from a shared BytesMut. (#​718)

v1.6.0

Compare Source

Added

• Add Bytes::is_unique (#​643)

Documented

• Fix changelog typo (#​628)
• Fix some spelling mistakes (#​633)
• Typo fix (#​637)
• Fix broken links (#​639)
• Add security policy (#​649)

Internal changes

• Move comment to correct constant (#​629)
• Various cleanup (#​635)
• Simplify UninitSlice::as_uninit_slice_mut() logic (#​644)
• Use self. instead of Self:: (#​642)
• BytesMut: Assert alignment of Shared (#​652)
• Remove unnecessary namespace qualifier (#​660)
• Remove an unnecessary else branch (#​662)
• Remove unreachable else branch (#​661)
• make parameter mut in From<Vec> (#​667)
• Restore commented tests (#​665)
• Use sub instead of offset (#​668)
• Calculate original capacity only if necessary (#​666)
• set_vec_pos does not need a second parameter (#​672)
• get_vec_pos: use &self instead of &mut self (#​670)
• Refactor split_at/split_to (#​663)
• Use Iterator from the prelude (#​673)
• copy_to_bytes: Add panic section to docs (#​676)
• Remove redundant reserve call (#​674)
• Use ManuallyDrop instead of mem::forget (#​675)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: runners/akula/Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path runners/akula/Cargo.toml --package bytes@1.5.0 --precise 1.11.1
    Updating git repository `https://github.com/vorot93/arrayvec`
remote: Repository not found.
fatal: repository 'https://github.com/vorot93/arrayvec/' not found
warning: spurious network error (3 tries remaining): process didn't exit successfully: `git fetch --no-tags --force --update-head-ok 'https://github.com/vorot93/arrayvec' '+9e430a94359435dfe8e21467f160708ebcc01226:refs/commit/9e430a94359435dfe8e21467f160708ebcc01226'` (exit status: 128)
remote: Repository not found.
fatal: repository 'https://github.com/vorot93/arrayvec/' not found
warning: spurious network error (2 tries remaining): process didn't exit successfully: `git fetch --no-tags --force --update-head-ok 'https://github.com/vorot93/arrayvec' '+9e430a94359435dfe8e21467f160708ebcc01226:refs/commit/9e430a94359435dfe8e21467f160708ebcc01226'` (exit status: 128)
remote: Repository not found.
fatal: repository 'https://github.com/vorot93/arrayvec/' not found
warning: spurious network error (1 try remaining): process didn't exit successfully: `git fetch --no-tags --force --update-head-ok 'https://github.com/vorot93/arrayvec' '+9e430a94359435dfe8e21467f160708ebcc01226:refs/commit/9e430a94359435dfe8e21467f160708ebcc01226'` (exit status: 128)
remote: Repository not found.
fatal: repository 'https://github.com/vorot93/arrayvec/' not found
error: failed to load source for dependency `arrayvec`

Caused by:
  Unable to update https://github.com/vorot93/arrayvec?branch=pop-unchecked#9e430a94

Caused by:
  failed to clone into: /home/ubuntu/.cargo/git/db/arrayvec-533b4f8a9804dc9a

Caused by:
  revision 9e430a94359435dfe8e21467f160708ebcc01226 not found

Caused by:
  process didn't exit successfully: `git fetch --no-tags --force --update-head-ok 'https://github.com/vorot93/arrayvec' '+9e430a94359435dfe8e21467f160708ebcc01226:refs/commit/9e430a94359435dfe8e21467f160708ebcc01226'` (exit status: 128)