---
id: "CVE-2026-68510"
page: "https://infrastack.ai/live/CVE-2026-68510"
kind: "vulnerability"
aliases: ["CVE-2026-68510"]
title: "bit-vec: deserializing untrusted data causes undefined behavior before 0.10.0"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bit-vec", "package", "rust", "serde"]
not_affected_if: ["no-deserialize", "trusted-input-only"]
published_at: "2026-11-13T19:19:35+00:00"
first_seen_at: "2026-11-13T19:52:10+00:00"
updated_at: "2026-11-13T19:54:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68510", "first_seen_at": "2026-11-13T19:52:10+00:00"}]
exploit_sources: []
---

# bit-vec: deserializing untrusted data causes undefined behavior before 0.10.0

Link for people: https://infrastack.ai/live/CVE-2026-68510 (this .md is for agents)

bit-vec is a Rust library for compact bit vectors. Deserializing a BitVec from an untrusted source and then running operations on it can trigger undefined behavior, which may give incorrect results or memory-safety problems.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `bit-vec` in `Cargo.lock` and note the version.
- Check whether the code calls deserialize (for example serde) on BitVec values that come from untrusted input.

## Fix

- `bit-vec` `0.10.0`

## Timeline

- 2026-11-13T19:52:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68510

## Documents

- [advisory] Vendor advisory: github.com https://github.com/contain-rs/bit-vec/security/advisories/GHSA-h4f4-f333-vh4h

## From the sources

bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_