CVE-2020-35861: Bumpalo Project Bumpalo

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.

Affected products

• Bumpalo Project Bumpalo: from 3.0.0, before 3.2.1 (fixed in 3.2.1)

Published 2020-12-31. Last modified 2026-06-17.