{"id":"CVE-2026-59010","kind":"vulnerability","aliases":["CVE-2026-59010"],"related":[],"title":"Rust legacy.rs deserializer: missing bounds check allows local denial of service","description":"In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","summary":"A missing bounds check in the deserialize function of legacy.rs can crash or stall the program that parses the data. The sources say an attacker with local access and no extra privileges can trigger it, and no user interaction is needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","rust"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T20:17:56+00:00","first_seen_at":"2026-11-02T20:35:36+00:00","triaged_at":"2026-11-02T20:36:59+00:00","updated_at":"2026-11-02T20:36:59+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-02T20:36:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Rust legacy.rs deserializer: missing bounds check allows local denial of service","impact":"low","summary":"A missing bounds check in the deserialize function of legacy.rs can crash or stall the program that parses the data. The sources say an attacker with local access and no extra privileges can trigger it, and no user interaction is needed.","audience":"developers","category":"other","nicknames":[],"who_cares":["rust"],"confidence":0.3,"fix_status":"unknown","needs_auth":"no","worst_case":"local program crashes or stalls from malformed input","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59010 and find the fixed release.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the affected product, package or versions, so the affected component is unknown. Only systems that run code containing legacy.rs deserialization on local input would be exposed, and the sources give no detail beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000618,"input_tokens":4079,"output_tokens":420,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-59010':14A,17A 'access':47B 'addit':88C 'allow':7A 'attack':44B 'bound':5A,22B,76C 'check':6A,23B,77C 'could':79C 'crash':31B 'cve':12A,15A 'data':39B 'denial':9A,69C,83C 'deseri':3A,26B,62C 'due':72C 'execut':89C 'exploit':98C 'extra':50B 'function':27B 'interact':58B,93C 'lead':80C 'legacy.rs':2A,29B,64C 'local':8A,46B,82C 'miss':4A,21B,75C 'need':60B,91C,96C 'pars':37B 'possibl':68C 'privileg':51B,90C 'program':35B 'rust':1A,19B 'say':42B 'servic':11A,71C,85C 'sourc':41B 'stall':33B 'trigger':53B 'user':57B,92C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the affected product, package or versions, so the affected component is unknown. Only systems that run code containing legacy.rs deserialization on local input would be exposed, and the sources give no detail beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["other","rust","unknown"],"first_public_at":"2026-11-02T20:17:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59010","severity":null,"published_at":"2026-11-02T20:17:56+00:00","modified_at":"2026-11-02T20:17:56+00:00","first_seen_at":"2026-11-02T20:35:36+00:00","fetched_at":"2026-11-02T20:35:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}