chore(deps): update rust crate bytes to v1.11.1 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
bytes	dependencies	minor	1.6.1 → 1.11.1

---

bytes has integer overflow in BytesMut::reserve

CVE-2026-25541 / GHSA-434x-w66g-qw3r

More information

Details

Details

In the unique reclaim path of BytesMut::reserve, the condition

if v_capacity >= new_cap + offset

uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

PoC

use bytes::*;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);

    // Ensure b becomes the unique owner of the backing storage
    drop(a);

    // Trigger overflow in new_cap + offset inside reserve
    b.reserve(usize::MAX - 6);

    // This call relies on the corrupted cap and may cause UB & HBO
    b.put_u8(b'h');
}

Workarounds

Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.

This vulnerability is also known as RUSTSEC-2026-0007.

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/tokio-rs/bytes/security/advisories/GHSA-434x-w66g-qw3r
• https://github.com/tokio-rs/bytes/commit/d0293b0e35838123c51ca5dfdf468ecafee4398f
• https://github.com/tokio-rs/bytes/releases/tag/v1.11.1
• https://rustsec.org/advisories/RUSTSEC-2026-0007.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-25541
• https://github.com/advisories/GHSA-434x-w66g-qw3r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tokio-rs/bytes (bytes)

v1.11.1

Compare Source

• Fix integer overflow in BytesMut::reserve

v1.11.0

Compare Source

• Bump MSRV to 1.57 (#​788)

Fixed

• fix: BytesMut only reuse if src has remaining (#​803)
• Specialize BytesMut::put::<Bytes> (#​793)
• Reserve capacity in BytesMut::put (#​794)
• Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#​795)

Internal changes

• Guarantee address in slice() for empty slices. (#​780)
• Rename Vtable::to_* -> Vtable::into_* (#​776)
• Fix latest clippy warnings (#​787)
• Ignore BytesMut::freeze doctest on wasm (#​790)
• Move drop_fn of from_owner into vtable (#​801)

v1.10.1

Compare Source

Fixed

• Fix memory leak when using to_vec with Bytes::from_owner (#​773)

v1.10.0

Compare Source

Added

• Add feature to support platforms without atomic CAS (#​467)
• try_get_* methods for Buf trait (#​753)
• Implement Buf::chunks_vectored for Take (#​617)
• Implement Buf::chunks_vectored for VecDeque<u8> (#​708)

Fixed

• Remove incorrect guarantee for chunks_vectored (#​754)
• Ensure that tests pass under panic=abort (#​749)

v1.9.0

Compare Source

Added

• Add Bytes::from_owner to enable externally-allocated memory (#​742)

Documented

• Fix typo in Buf::chunk() comment (#​744)

Internal changes

• Replace BufMut::put with BufMut::put_slice in Writer impl (#​745)
• Rename hex_impl! to fmt_impl! and reuse it for fmt::Debug (#​743)

v1.8.0

Compare Source

• Guarantee address in split_off/split_to for empty slices (#​740)

v1.7.2

Compare Source

Fixed

• Fix default impl of Buf::{get_int, get_int_le} (#​732)

Documented

• Fix double spaces in comments and doc comments (#​731)

Internal changes

• Ensure BytesMut::advance reduces capacity (#​728)

v1.7.1

Compare Source

This release reverts the following change due to a regression:

• Reuse capacity when possible in <BytesMut as Buf>::advance impl (#​698)

The revert can be found at #​726.

v1.7.0

Compare Source

Added

• Add conversion from Bytes to BytesMut (#​695, #​710)
• Add reclaim method without additional allocation (#​686)

Documented

• Clarify how BytesMut::zeroed works (#​714)
• Clarify the behavior of Buf::chunk (#​717)

Changed

• Change length condition of BytesMut::truncate
• Reuse capacity when possible in <BytesMut as Buf>::advance impl (#​698)
• Improve must_use suggestion of BytesMut::split (#​699)

Internal changes

• Use ManuallyDrop instead of mem::forget (#​678)
• Don't set len in BytesMut::reserve (#​682)
• Optimize Bytes::copy_to_bytes (#​688)
• Refactor BytesMut::truncate (#​694)
• Refactor BytesMut::resize (#​696)
• Reorder assertion in Bytes::split_to, Bytes::split_off (#​689, #​693)
• Use offset_from in more places (#​705)
• Correct the wrong usage of IntoIter (#​707)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.