{"id":"CVE-2026-68510","kind":"vulnerability","aliases":["CVE-2026-68510"],"related":[],"title":"bit-vec: deserializing untrusted data causes undefined behavior before 0.10.0","description":"bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0.","summary":"bit-vec is a Rust library for compact bit vectors. Deserializing a BitVec from an untrusted source and then running operations on it can trigger undefined behavior, which may give incorrect results or memory-safety problems.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bit-vec","package","rust","serde"],"not_affected_if":["no-deserialize","trusted-input-only"],"how_to_check":"- Look for `bit-vec` in `Cargo.lock` and note the version.\n- Check whether the code calls deserialize (for example serde) on BitVec values that come from untrusted input.","fix":"- `bit-vec` `0.10.0`","status":"open","published_at":"2026-11-13T19:19:35+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","triaged_at":"2026-11-13T19:54:12+00:00","updated_at":"2026-11-13T19:54:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T19:54:12Z","model":"claude-haiku-5-5","output":{"fix":"- `bit-vec` `0.10.0`","reach":"unknown","title":"bit-vec: deserializing untrusted data causes undefined behavior before 0.10.0","impact":"medium","summary":"bit-vec is a Rust library for compact bit vectors. Deserializing a BitVec from an untrusted source and then running operations on it can trigger undefined behavior, which may give incorrect results or memory-safety problems.","audience":"developers","category":"package","nicknames":[],"who_cares":["rust","bit-vec","serde"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"undefined behavior and incorrect results from crafted serialized input","analyst_note":"","how_to_check":"- Look for `bit-vec` in `Cargo.lock` and note the version.\n- Check whether the code calls deserialize (for example serde) on BitVec values that come from untrusted input.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-input-only","no-deserialize"],"who_is_affected":"Only applications that deserialize BitVec values from untrusted sources and then operate on them are at risk. Projects that only build BitVec values locally, or that use trusted data, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4572,"output_tokens":466,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-68510':14A,17A '0.10.0':11A,74C,125C 'behavior':9A,51B,78C,102C 'bit':2A,19B,25B,33B,63C,70C 'bit-vec':1A,18B,24B,62C 'bitvec':37B,117C 'caus':7A 'compact':32B,67C 'cve':12A,15A 'data':6A 'deseri':4A,35B,83C,106C,116C 'get':90C 'give':54B 'impact':99C 'incorrect':55B,101C 'issu':119C 'librari':30B,96C 'may':53B,97C 'memori':59B 'memory-safeti':58B 'oper':45B,113C 'packag':21B 'patch':122C 'perform':82C,105C 'prior':71C 'problem':61B 'result':56B 'run':44B,112C 'rust':22B,29B 'safeti':60B 'serd':23B 'sourc':41B,87C,110C 'trigger':49B 'uncheck':91C 'undefin':8A,50B,77C 'unsaf':89C 'untrust':5A,40B,86C,109C 'user':81C,93C 'vec':3A,20B,26B,64C 'vector':34B,68C 'version':73C,124C","nicknames":[],"mitigations":[],"who_affected":"Only applications that deserialize BitVec values from untrusted sources and then operate on them are at risk. Projects that only build BitVec values locally, or that use trusted data, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bitvec","medium","package","rust","serde"],"campaign_type":null,"search_a":"'-2026':13A,16A '-68510':14A,17A '0.10.0':11A 'behavior':9A 'bit':2A 'bit-vec':1A 'caus':7A 'cve':12A,15A 'data':6A 'deseri':4A 'undefin':8A 'untrust':5A 'vec':3A","search_b":"'behavior':51B 'bit':19B,25B,33B 'bit-vec':18B,24B 'bitvec':37B 'compact':32B 'deseri':35B 'give':54B 'incorrect':55B 'librari':30B 'may':53B 'memori':59B 'memory-safeti':58B 'oper':45B 'packag':21B 'problem':61B 'result':56B 'run':44B 'rust':22B,29B 'safeti':60B 'serd':23B 'sourc':41B 'trigger':49B 'undefin':50B 'untrust':40B 'vec':20B,26B 'vector':34B","search_c":"'0.10.0':74C,125C 'behavior':78C,102C 'bit':63C,70C 'bit-vec':62C 'bitvec':117C 'compact':67C 'deseri':83C,106C,116C 'get':90C 'impact':99C 'incorrect':101C 'issu':119C 'librari':96C 'may':97C 'oper':113C 'patch':122C 'perform':82C,105C 'prior':71C 'run':112C 'sourc':87C,110C 'uncheck':91C 'undefin':77C 'unsaf':89C 'untrust':86C,109C 'user':81C,93C 'vec':64C 'vector':68C 'version':73C,124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T14:00:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68510","severity":null,"published_at":"2026-11-13T19:19:35+00:00","modified_at":"2026-11-13T19:19:35+00:00","first_seen_at":"2026-11-13T19:52:10+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":149171,"url":"https://github.com/contain-rs/bit-vec/security/advisories/GHSA-h4f4-f333-vh4h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T14:00:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}